Security audit

theme-factory

Security checks for vulnerabilities and agentic risk

Overview

This skill is marketed as a theme/styling tool but asks for broad execution authority and describes generic automation, API credentials, file handling, and command execution beyond that purpose.

Review this carefully before installing. It may be acceptable only if you intend to grant a broad automation skill access to files, commands, and possible API credentials; if you only need artifact theming, ask the publisher for a narrower version that removes exec and documents exact local file and network behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill metadata presents a narrow theming/styling toolkit, but the content and declared tools include generic execution capability (`exec`) and broader automation behavior. This mismatch is dangerous because users and orchestrators may grant trust or invoke the skill under false assumptions, enabling command or external-action behavior outside the expected styling scope.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documented 'core processing' describes generic data handling, retries, source validation, and GitHub-related provenance rather than artifact styling. In a skill advertised for theming, this kind of capability drift can conceal broader operational behavior and make policy gating ineffective, increasing the chance of unintended data access or execution paths.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The setup and troubleshooting sections instruct API-key configuration, external connections, file handling, and command execution, which materially exceed the expected behavior of a simple theming skill. This discrepancy can lead operators to expose credentials or authorize risky actions without realizing the skill may perform external/API or shell-like operations.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger condition 'when the user needs to perform related operations' is so broad that the skill may be invoked in ambiguous contexts. For a skill with mismatched and potentially powerful documented behavior, vague triggering increases the risk of accidental activation and unintended execution or data handling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill text references API keys, file paths, permissions, and command failures, but does not clearly warn users that it may execute commands, manipulate files, or interact with external services. This omission undermines informed consent and increases the chance users provide sensitive inputs or approve the skill for low-risk styling tasks that actually involve higher-risk operations.

Static analysis

No suspicious patterns detected.