Security audit

Token Saver Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a prompt-only token-saving helper, but it requests broad execution authority and describes automatic caching/compression behavior without clear implementation, limits, or privacy controls.

Review this carefully before installing. It does not show code that actually performs safe token optimization, yet it asks for exec access and describes caching conversation content. Use only if you are comfortable with a prompt-level helper influencing context handling, and avoid using it for sensitive or precision-critical work unless caching and compression behavior are clearly controlled by the host agent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill advertises concrete optimization behaviors such as compression, semantic caching, analytics, and command execution, but the file contains only narrative instructions and example outputs with no enforceable implementation or constraints. In an agent setting, this creates deceptive capability claims that can mislead users and downstream systems into believing data is being optimized or handled safely when there is no verifiable mechanism, increasing the chance of silent context loss, incorrect cache assumptions, or unsafe tool use.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation explicitly claims that risky code was removed and safety was enhanced, yet the manifest still grants the skill exec capability without any constrained command list, validation logic, or implementation showing how execution is safely bounded. This mismatch is dangerous because safety assurances may cause operators to trust a skill that still has access to a high-risk tool surface.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger keywords are broad and generic terms like 'token', 'smart', 'skill', and 'optimization', which can cause unintended activation in unrelated conversations. In an agent environment, accidental activation can lead to unsolicited behavior changes, confusing command interpretation, or inappropriate tool invocation based on normal user dialogue.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The natural-language invocation guidance tells the agent to 'interpret and execute' a wide range of loosely phrased user requests, including mode changes and cache operations, without confirmation boundaries. This broad mapping increases the risk of the agent taking action on ambiguous language, especially when the skill also declares exec capability and presents operational commands as if they are real.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The semantic cache feature implies storing and reusing prior conversation content, but the skill does not clearly warn users about what data may be retained, for how long, or whether sensitive prompts could be reused across contexts. In conversational systems, unclear caching behavior can expose private or proprietary information through unintended retention or cross-query reuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Automatic context compression is described as preserving important content, but the skill does not clearly warn that summarization may alter nuance, omit details, or affect downstream decisions. In agent workflows involving technical, legal, or operational tasks, silent compression can cause loss of context integrity and lead to incorrect outputs or unsafe actions.

Static analysis

No suspicious patterns detected.