Security audit

把对话讨论转为结构化

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly describes conversation-to-document formatting, but it asks for broad local and command authority and makes unsupported safety claims about filtering sensitive information.

Review before installing. This does not show malicious behavior, but it grants broad agent capabilities for a documentation-formatting skill and overstates sensitive-data protection. Avoid submitting confidential transcripts unless you independently redact them first, and only allow file access, external calls, or command execution when you explicitly intend those actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill claims it will automatically identify and filter sensitive information, but the file is only documentation/manifest content and provides no enforceable implementation, policy, or validation logic. This can create dangerous user trust, leading operators to submit confidential transcripts under a false assumption of protection, which may result in sensitive data disclosure to the agent, logs, templates, or downstream services.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a narrowly scoped conversation-to-Notion formatter, but later documentation broadens it into generic file handling, API integration, command execution, and automation. This scope expansion weakens least-privilege expectations and can mislead users or agents into granting capabilities far beyond what is necessary for the advertised purpose, increasing the chance of unsafe data access or system-impacting actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Documenting system command execution as a capability is not justified by the stated task of structuring conversations into Notion documentation. In this context, unnecessary exec capability expands the attack surface for prompt injection, unsafe shell use, or unintended host interaction without a legitimate functional need.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises file handling, external API use, and command execution, but does not clearly warn users about possible data exfiltration, file modification, network transmission, or local system effects. That omission undermines informed consent and makes socially engineering users into risky workflows easier, especially for a skill expected to process potentially sensitive conversation content.

Static analysis

No suspicious patterns detected.