T08 · Insecure Dependencies
Warning
- Location
SKILL.md:146- Finding
Unpinned and Unnecessary Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Creator Tool Free
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate skill-authoring purpose, but it grants broad write and exec authority with weak scoping and safeguards, so it should be reviewed before installation.
Install only if you are comfortable with a skill that can create or overwrite skill instruction files and may run setup commands. Use it in a limited workspace, avoid callback_url unless you trust the endpoint, and review generated paths before allowing file writes or command execution.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:155- Finding
Arbitrary Filesystem Write Through Unsanitized Skill Name
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill exposes read, write, and exec capabilities in metadata and body content without prominent warning about filesystem mutation and command execution consequences. For a user-facing creation tool, this lack of disclosure and guardrails materially raises the risk of unintended file changes, command execution, or abuse via prompt-triggered actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is marketed as a streamlined creation/validation tool, but the documented capability scope also includes modification and deletion operations. This scope mismatch can mislead users and agents about what actions are authorized, increasing the chance of unintended destructive behavior when write/exec permissions are available.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases and usage examples are broad enough to overlap with ordinary user requests such as creating, validating, or optimizing content. This increases the risk of accidental invocation, causing the agent to enter a higher-privilege skill path and potentially perform write or exec-backed actions without the user's informed intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A callback URL introduces outbound communication capability that is unrelated to a local skill-authoring workflow and can be abused for data exfiltration or unreviewed network interaction. In combination with read/write/exec permissions, this creates an unnecessary channel for sending workspace contents or execution results to external endpoints.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Documenting installation of the requests package adds network-capable functionality without a corresponding need in the stated purpose of generating and validating SKILL.md files. Unnecessary network dependencies expand attack surface and make it easier for future instructions or code paths to fetch remote content or exfiltrate local data.
- Content