Security audit

自适应设计偏好引擎

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its design-preference purpose, but it asks for broad tool access and automatically stores user preference data without enough scoping or privacy controls.

Review before installing. Use this only if you are comfortable with an agent maintaining a continuing design-preference profile. Avoid using it on confidential client or brand work unless storage location, retention, deletion, callback behavior, and exec usage are clarified or constrained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as a design-preference learning tool, but later sections advertise generic file processing, command execution, API aggregation, and batch automation capabilities. This scope expansion is dangerous because the skill declares exec, read, and write tools, so ambiguous documentation can normalize or justify risky operations beyond the user’s expected design-only context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file says design-tool control and rendering/output automation are out of scope, yet other sections imply exec-based command handling and file-generation workflows. These conflicting instructions can cause an agent to perform actions the user would reasonably believe are prohibited, increasing the chance of unsafe execution or unauthorized file manipulation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly describes automatic learning and persistence of user preferences derived from choices, feedback, and reactions, but does not provide a clear upfront warning or consent mechanism for storing behavioral data. That creates a privacy risk because users may disclose sensitive preferences or project details without understanding they will be retained across sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented callback_url enables sending results to an external endpoint, but there is no warning that user inputs, outputs, or metadata may leave the local agent context. This can lead to unintended data exfiltration, especially if users supply third-party URLs or do not realize asynchronous delivery transmits content externally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to observe, persist, and reuse user interaction details as a continuing preference profile. In context, this is a semantic retention risk because the stored profile may contain sensitive preferences, client/brand associations, and project-specific signals that can later be disclosed, reused inappropriately, or retained longer than necessary.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: These sections repeatedly direct the agent to record user choices, reactions, and modifications into structured long-term archives. That is risky because interaction history can reveal sensitive design intent, business preferences, internal brand strategy, or personal tendencies, and the file does not specify minimization, access control, or safe retention limits.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The operational workflow explicitly tells the agent to monitor interactions and write confirmed preferences into a file for future use. Because the skill also has write capability, this is not merely descriptive; it operationalizes persistent user-data storage without sufficient privacy guardrails, creating elevated risk of retention, cross-project leakage, or unauthorized reuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.