Security audit

文档

Security checks for vulnerabilities and agentic risk

Overview

This skill is a review concern because it claims strong encrypted-document privacy while also requesting read, write, command execution, online/API use, and an API key without clear boundaries.

Install only if you are comfortable giving the agent read/write access, command execution, and API-backed processing for documents. Do not use it for confidential encrypted documents unless the publisher clarifies what stays local, what may be sent externally, which commands may run, and when user confirmation is required.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The skill markets itself as end-to-end encrypted and privacy-preserving, yet also exposes general command execution and external API integration. That combination creates a material mismatch between the user’s security expectations and the actual trust boundary, because sensitive content may be processed outside a strictly local encrypted workflow or trigger actions unrelated to document encryption.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation claims privacy-preserving end-to-end encryption, but elsewhere states the skill depends on an LLM API and online access. If document contents or keys are sent to remote services, the skill is not meaningfully end-to-end in the way users would expect, creating a risk of sensitive data disclosure through misleading security claims.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: General command execution is not justified by the stated purpose of encrypted document collaboration and processing. Unnecessary exec capability enlarges the attack surface significantly, enabling misuse for arbitrary system actions if the skill is invoked with attacker-controlled inputs or ambiguous instructions.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guidance is broad and ambiguous, encouraging use for general file processing, conversion, and content extraction without clearly delimiting safe operations. In a skill that also has read/write/exec capabilities, vague scope increases the chance that the agent will perform higher-risk actions than the user intended.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The markdown describes file handling, API integration, and command execution but does not provide a clear, prominent warning that the skill may write files or execute commands. Users may invoke it expecting passive document processing, which raises the risk of unintended system changes or unsafe actions under misleading UX.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill discusses API-key use and LLM-backed operation but omits a direct privacy warning that sensitive document contents may be processed by external services. For a tool marketed around encrypted documents and privacy, that omission is especially dangerous because users are more likely to trust it with confidential material.

Static analysis

No suspicious patterns detected.