Skill Collision Guard

• Outcome: Review
• Latest audit: Sep 4, 2026 · 7:44 AM UTC
• Version: 0.1.0

Overview

The skill reads local or candidate skill instructions to detect conflicts and only writes reversible session-suppression state, with the main sensitive behaviors disclosed and aligned to that purpose.

Install only if you are comfortable with a tool that reads installed SKILL.md files across configured agent skill roots and may clone remote candidate repositories for inspection. Use --agent to keep scans scoped to the current agent, and prefer reversible session suppression over permanent removal unless you intentionally decide to delete another skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is framed as a comparison/suppression helper, but it also directs broad local SKILL.md discovery and reading. In the context of agent skills, undocumented inventory and filesystem traversal is risky because it can expose sensitive project, user, or system configuration details beyond what a user may expect from a simple conflict-checking tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill is framed as a comparison/suppression helper, but it also directs broad local SKILL.md discovery and reading. In the context of agent skills, undocumented inventory and filesystem traversal is risky because it can expose sensitive project, user, or system configuration details beyond what a user may expect from a simple conflict-checking tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is framed as a comparison/suppression helper, but it also directs broad local SKILL.md discovery and reading. In the context of agent skills, undocumented inventory and filesystem traversal is risky because it can expose sensitive project, user, or system configuration details beyond what a user may expect from a simple conflict-checking tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is framed as a comparison/suppression helper, but it also directs broad local SKILL.md discovery and reading. In the context of agent skills, undocumented inventory and filesystem traversal is risky because it can expose sensitive project, user, or system configuration details beyond what a user may expect from a simple conflict-checking tool.

Ae1

High

• Category: analysis-evasion

Content

Use the deterministic CLI bundled with this skill instead of judging conflicts from names alone. Resolve the runtime root from this `SKILL.md` path:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use the deterministic CLI bundled with this skill instead of judging conflicts from names alone. Resolve the runtime root from this `SKILL.md` path:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Use the deterministic CLI bundled with this skill instead of judging conflicts from names alone. Resolve the runtime root from this `SKILL.md` path:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- Host plugin bundle: use the nearest ancestor that contains `bin/skill-guard.js` and `src/`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares required binaries and describes use of environment-controlled state paths, but it does not define an explicit tool/permission scope. In a skill system that relies on metadata for sandboxing or user consent, this can lead to the skill being used with broader filesystem and environment access than reviewers expect.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt is phrased broadly enough that the skill may be invoked in many contexts involving skills or installation checks, increasing the chance of unintended activation. Because this skill can influence whether other skills are installed or suppressed, accidental triggering could alter agent behavior or decision-making in ways the user did not explicitly request.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

['write policy', /\b(read[- ]only|do not (edit|implement|modify)|no code changes)\b/i,
    /\b(implement|edit files|make the change|write the code)\b/i],
  ['approval policy', /\b(ask|confirm|approval).{0,30}\b(before|first)\b/i,
    /\b(do not ask|without asking|proceed autonomously|no confirmation)\b/i],
  ['test policy', /\b(skip|do not (run|write)|without)\s+(the\s+)?tests?\b/i,
    /\b(test[- ]driven|run (the )?tests|write tests|red[- ]green[- ]refactor)\b/i],
];

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

['write policy', /\b(read[- ]only|do not (edit|implement|modify)|no code changes)\b/i,
    /\b(implement|edit files|make the change|write the code)\b/i],
  ['approval policy', /\b(ask|confirm|approval).{0,30}\b(before|first)\b/i,
    /\b(do not ask|without asking|proceed autonomously|no confirmation)\b/i],
  ['test policy', /\b(skip|do not (run|write)|without)\s+(the\s+)?tests?\b/i,
    /\b(test[- ]driven|run (the )?tests|write tests|red[- ]green[- ]refactor)\b/i],
];

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The prompt matcher will auto-select skills when token overlap reaches a low threshold (intent >= 0.16), even when the user did not explicitly invoke that skill. In a system that installs, suppresses, or routes between agent skills, this can cause unintended skill activation or collision handling decisions without clear user disclosure, especially for broad or ambiguous prompts.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest describes comparing skills before installation and helping suppress one for the current session, which suggests local skill analysis. This code additionally supports remote references and performs `git clone` of external repositories into a temporary directory to inspect them, a materially broader behavior than the manifest description states.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The stated purpose is to detect overlapping or contradictory skills and help disable one for the session. Spawning a system `git` process to clone arbitrary remote references is a privileged implementation capability that is not mentioned in the manifest and is not obviously required for a collision-checker unless remote inspection is explicitly in scope.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This code generates a recommendation telling the user they may 'remove installed' skill permanently, which is a potentially destructive or irreversible operation. Although phrased as a recommendation string rather than executing the action directly, this file does not include an explicit warning about the permanence or possible impact of removal beyond the brief wording itself.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code recursively walks directories and follows symbolic links during skill discovery, which can inspect filesystem locations outside the user's expected tree. There is no confirmation prompt, user-facing log, or inline warning indicating that linked directories may be traversed.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/candidate.js:78