Security audit

Validate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a startup-validation workflow, but it asks the agent to create a project file while its manifest advertises only read access.

Review this skill before installing if you expect read-only validation. It is not evidence of malware, but it can read project or knowledge-base Markdown, use web research, and create docs/prd.md in the current project. Install only if you are comfortable with that write behavior, and prefer running it in a repository where creating or overwriting that file is acceptable.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill presents itself as a validation/analysis workflow but instructs the agent to create `docs/prd.md`, which is a state-changing filesystem write. That mismatch can cause users or orchestrators to treat the skill as read-only and invoke it in contexts where writes are unexpected, creating a consent and integrity risk for the workspace.

Scope Creep

High

Confidence: 99% confidence
Finding: The manifest declares only the `read` tool, yet the instructions require writing a PRD file. This is a capability mismatch that can bypass policy assumptions, confuse tool governance, or encourage an agent to improvise unauthorized write behavior through other means.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger keywords include broad everyday terms like `through`, `validate`, `score`, `startup`, and `idea`, making accidental invocation likely. Overbroad triggering expands the skill's activation surface, which can cause it to run in unrelated conversations and perform unintended analysis or side-effecting steps.

Vague Triggers

High

Confidence: 91% confidence
Finding: The repeated keyword list remains underspecified and broad, reinforcing the same accidental-trigger risk elsewhere in the file. Duplicating ambiguous activation guidance increases the chance that host systems or prompt routers will match on generic language and invoke the skill unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs creation of `docs/prd.md` without warning the user that it will modify the workspace. Unannounced writes undermine informed consent and may overwrite or add files in repositories where the user expected analysis only.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill describes `MD+execute` behavior and partial need for command execution capability without a clear safety warning. While it does not include direct malicious commands, normalizing execution-capable behavior without disclosure can lead users to invoke it in more privileged environments than intended.

Static analysis

No suspicious patterns detected.