Security audit

spec-driven-developm

Security checks for vulnerabilities and agentic risk

Overview

The skill does not show malicious behavior, but it asks for broad command, file, API, and credential-related authority that is not well scoped to writing specifications.

Review this skill carefully before installing. It appears to be a generic generated skill rather than a tightly scoped spec-writing assistant. Only use it in a constrained environment, avoid giving it real API keys unless you know exactly what service it will call, and require explicit approval before it runs commands or processes local files.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill is presented as a specification-authoring tool, but its documented behavior is generic automation rather than constrained spec creation. This mismatch can cause an agent or user to invoke the skill under a low-risk assumption while actually enabling broader operational behavior than expected.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Declaring exec for a skill whose stated purpose is writing specifications introduces unnecessary command-execution capability. In an agent environment, this expands the attack surface substantially because prompt-driven or ambiguous instructions could cause local shell commands to run without clear justification tied to the skill's purpose.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill's description materially broadens from spec creation into automation, data analysis, workflow orchestration, API usage, file processing, and command execution. This overbroad scope is dangerous because it masks high-privilege behaviors behind an innocuous name, increasing the chance of unsafe invocation and privilege misuse.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documentation instructs users to configure API keys and perform API/network interactions even though those capabilities are not clearly necessary for writing specs. Unjustified credential handling increases the risk of secret exposure, unintended outbound data transfer, and misuse of external services from a skill users may consider low risk.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation description is ambiguous and overly broad, including vague language around automation, data analysis, and workflow orchestration. Broad trigger conditions make accidental invocation more likely and can route users into a skill with stronger capabilities than they intended to use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill references API keys, file handling, command execution, and API calls without prominent user-facing warnings about side effects, data exposure, or privilege implications. In an agent setting, insufficient disclosure can lead to users unknowingly authorizing sensitive operations such as outbound requests, filesystem access, or shell execution.

Static analysis

No suspicious patterns detected.