Security audit

better-readme

Security checks for vulnerabilities and agentic risk

Overview

This skill is a README auditing and generation helper with disclosed project scanning and optional public-repository onboarding, with no evidence of hidden execution, credential theft, or destructive behavior.

Installers should be comfortable with the skill inspecting the current project to build and score READMEs. Decline the first-use GitHub repo evaluation unless you want public repository names and README contents reviewed in bulk; prefer selecting specific repos rather than evaluating all.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented behavior exceeds and diverges from the declared README-focused purpose by scanning broader repository contents, inferring project type, and invoking functionality not cleanly represented in the manifest. This kind of description-behavior mismatch is dangerous because users and platform policy may rely on the manifest for consent and risk evaluation, while the skill actually performs more invasive analysis than advertised.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
| `SKILL.md` exists, `skills/` directory | **Agent Skill** |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "Check my README" is broad natural language that can match ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, accidental activation is more concerning because the documented workflow includes scanning projects and potentially escalating into repository-audit onboarding.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README documents an onboarding flow that offers to fetch and batch-evaluate a user's GitHub repositories, which expands the skill from README editing into cross-repository discovery and analysis. That is a meaningful scope increase for a documentation-focused skill and can lead to unnecessary access to user data and surprise collection/processing beyond what the user requested.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes fetching the user's GitHub repositories during onboarding without an accompanying privacy notice, scope disclosure, or data-handling warning. That omission undermines informed consent and makes users more likely to authorize broad access without understanding what information will be enumerated or processed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Fetching a user's GitHub repositories is not necessary to improve a single README and creates an avoidable data-access pathway. Even if intended as convenience, it increases privacy risk and expands the blast radius from one project to a user's broader repository set.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed prompts (for example, "Write a README for this project" and "My README sucks, fix it") are common user requests and lack precise activation boundaries. Overbroad triggers raise the chance that the skill runs in contexts where the user expected simple advice, but the agent instead scans files or initiates broader workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README encourages invocation through a very broad natural-language request like “检查一下我的 README”, which can easily overlap with ordinary user conversation. In agent platforms that trigger skills from README examples or phrase matching, this can cause unintended activation, repository scanning, or file generation without the user explicitly choosing this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The listed trigger phrases are generic everyday requests—such as writing, scoring, or fixing a README—and lack any namespace or explicit activation boundary. In systems that map user utterances directly to skills, these phrases increase the chance of accidental skill execution and may lead the agent to inspect the codebase and generate or alter documentation when the user did not intend to invoke this specific skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs shell execution and filesystem inspection but does not declare any tool scope or allowed-tools constraints. In an agent environment, this creates an implicit capability boundary issue: the model may use broader tools than users expect, increasing the chance of unintended command execution or repository-wide data access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation triggers are broad enough to match ordinary conversation such as 'my README is bad' or 'I need a README template,' which raises the chance of over-triggering the skill in contexts where the user did not intend repo scanning or audit behavior. Over-broad activation is primarily a safety and consent issue because it can cause the agent to enter a more powerful workflow than warranted.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The onboarding flow expands a README-assistance skill into GitHub repository discovery and bulk evaluation of public repos. Even if public data is involved, this is a scope expansion that can surprise users, create unnecessary profiling of their projects, and normalize collection of account-level information unrelated to the immediate request.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Enumerating a user's GitHub repositories is not clearly necessary for basic README creation or improvement, so it introduces unnecessary data exposure and account mapping. In an agent context, even public-repo enumeration can reveal the user's broader activity footprint and may be combined with other capabilities for unintended profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow directs the agent to fetch the user's public GitHub repositories without an explicit privacy notice explaining what data will be accessed, how it will be used, and whether anything is retained. Lack of transparent disclosure undermines informed consent and increases the risk of users unknowingly authorizing broader account-level analysis.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The agent-skill template tells authors to document trigger phrases and matching scenarios using unconstrained placeholders, but provides no guidance on narrowing scope, adding exclusions, or preventing ambiguous activation. In an agent ecosystem, this can lead downstream skill authors to create overly broad triggers that fire in unrelated contexts, causing incorrect tool use, interference with other skills, or unsafe handling of sensitive tasks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README claims '8 scoring dimensions' on line L012, but the scoring section later describes '9-dimension scoring' and lists nine dimensions. This is an intent/documentation divergence that can mislead users about what the skill actually evaluates.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill manifest scopes this skill to creating, improving, fixing, auditing, and scoring README files, but this code also classifies repositories as agent-skill, data-resource, CLI tool, app product, or library by inspecting directory contents and package metadata. That repository-typing capability is not necessary to audit a README itself and extends beyond the stated README-focused purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.