Security audit

驱动

Security checks for vulnerabilities and agentic risk

Overview

This brand-design skill is not clearly malicious, but it asks for broad read/write/command authority and includes generic automation scenarios that do not fit a logo-generation purpose.

Review this skill before installing. It may be useful for brand identity generation, but only grant command execution and broad file access if you are comfortable with a logo-design skill also acting as a generic automation driver. Prefer a version that removes exec, narrows file access to explicit brand-output files, and separates deployment or environment-management behavior into another skill.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is presented as a logo and brand identity generator, but the manifest and body also advertise generic file handling, API integration, and command execution. This capability mismatch is dangerous because it can cause an agent or operator to grant powerful permissions under a harmless-looking design label, creating an avenue for unintended filesystem access, external data transfer, or command execution.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Documenting system command execution as a supported capability for a brand identity skill introduces a high-risk primitive that is unrelated to the stated purpose. Even without explicit malicious commands in the file, normalizing exec in this context increases the chance that user-controlled input could later be routed into shell commands or that the skill could be abused as a generic execution wrapper.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The documented scenarios expand from brand design into environment management and deployment-style automation, which materially broadens the implied authority and expected behavior of the skill. This makes the skill more dangerous in context because a creative-design wrapper can become cover for operational actions that touch systems, files, or infrastructure beyond user expectations.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation begins as a focused brand identity generator but shifts into describing a generic 'driver' with executable commands and code snippets. This inconsistency can mislead users and security systems about the real behavior and trust boundary of the skill, increasing the risk of overbroad approval and unsafe invocation.

Static analysis

No suspicious patterns detected.