Security audit

writing-assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only writing prompt with overstated automation claims, but no evidence of hidden execution, data theft, destructive actions, persistence, or privileged access.

Install only if you want a prompt-style writing assistant. Do not rely on it to actually coordinate multiple writers or enforce assignment controls, and avoid giving it sensitive reference material unless the host agent and model context are appropriate for that content.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest exposes only a read tool, but the documentation promises analysis, assignment, coordination, and content generation. This mismatch can mislead users or calling agents about the skill’s actual execution surface, causing unsafe delegation assumptions, workflow failures, or unintended invocation patterns based on nonexistent capabilities.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims automatic assignment and multi-writer coordination via protocol tools, yet no such implementation is declared beyond read access. This is dangerous because operators may trust the skill to orchestrate other tools or agents, creating a deceptive control surface that can confuse authorization, auditing, and safe task routing.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The capability section describes automated analysis, assignment, reference selection, and content generation despite the skill being only a Markdown wrapper with a read tool. Such overstated capabilities can cause overtrust in autonomous behavior and lead other agents or users to provide sensitive inputs or rely on nonexistent safeguards and controls.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The description uses very broad language about professional support, multiple workflows, and automated handling without clear activation boundaries. Overbroad trigger language can cause a hosting agent to invoke the skill for unrelated requests, increasing prompt-surface exposure and the chance of unintended instruction takeover or task interception.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The core functionality statement is so generic that it could match many unrelated tasks. In agentic systems, vague matching criteria increase accidental invocation risk, which can divert requests into an ill-scoped skill and expose user content to irrelevant instructions.

Vague Triggers

Low

Confidence: 74% confidence
Finding: The examples and scenarios are nonspecific, leaving the trigger scope ambiguous. While less severe than direct permission issues, unclear examples make it harder for an agent to determine appropriate use, increasing the likelihood of accidental activation and unreliable behavior.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The skill advertises Chinese interaction support in a way that may steer or force language choice without explicit user opt-in. This can override user expectations, degrade usability, and in multi-agent settings cause instruction mismatches or misinterpretation if the host/user requested another language.

Static analysis

No suspicious patterns detected.