Data Leak Detector

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.0

Overview

This is a coherent static analysis helper for checking files or skills for leak-risk patterns, with one avoidable unused dependency to review.

Use this only on folders you are comfortable letting the agent read for static analysis. Before installing, consider removing or declining the unused watchdog dependency, or install in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unnecessary Third-Party Dependency Expands Supply-Chain Attack Surface

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Unnecessary third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

yaml

dependencies: "pip install watchdog"

Technical Analysis

The Skill instructs users to install the third-party watchdog package, but the embedded implementation neither imports nor uses it. The implementation relies exclusively on Python standard-library modules:

python

import os
import re
import json
from pathlib import Path

The declared functionality is static file analysis and does not require filesystem event monitoring. Consequently, installing watchdog exceeds the minimum dependencies needed for the Skill to operate.

No evidence indicates that the legitimate watchdog package is malicious. The security issue is the avoidable supply-chain exposure created by downloading and installing an unused package from a configured package index. Risks include compromise of the package distribution channel, dependency substitution through a malicious index configuration, or future compromise of a package or transitive dependency.

Attack Path

1. A user installs the Skill and follows its dependency declaration.
2. pip install watchdog contacts the configured Python package index or mirror.
3. An attacker must first compromise the relevant package distribution path, configured mirror, package release, or dependency resolution environment.
4. pip downloads and installs the attacker-controlled package artifact.
5. Malicious installation or subsequently imported package code executes with the privileges of the user performing the installation.

This path is conditional on an external supply-chain compromise; the audited project itself does not retrieve or execute a remote payload directly.

Impact Assessment

Successful exploitation could execute attacker-controlled code with the privileges of the account installing the dependency. Depending on those privile ...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unused dependency declaration:

yaml

# Remove this line:
dependencies: "pip install watchdog"

2. Retain only dependencies demonstrably required by the implementation. The current scanner uses Python standard-library modules and does not require an external package.

3. If filesystem event monitoring is added in the future and watchdog becomes necessary:

   • Pin it to an explicitly reviewed version.
   • Use a trusted package index.
   • Verify package hashes with a locked requirements file.
   • Audit transitive dependencies.
   • Document the functionality that requires the dependency.
   • Install it in an isolated, least-privileged environment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description contains both Chinese and English directives, which implies a language preference/presentation choice without explicitly offering opt-in or user selection. Under the stated policy, forcing or assuming a specific language/locale without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The trigger list hard-codes Chinese and English phrases but does not say that language selection depends on user preference or that the skill is limited to a specific locale. This can be read as a language-policy issue because the skill behavior is tied to fixed languages without opt-in.

Content

No source excerpt is available for this finding.