Security audit

Learning Pack

Security checks for vulnerabilities and agentic risk

Overview

This learning pack is mostly coherent, but it gives beginner-facing access to powerful file, shell, messaging, and Git actions with weak safeguards around secrets and automatic commits.

Review this before installing in any real project. Do not paste passwords, tokens, or API keys into chat, verify message destinations before sending anything externally, and avoid the git-aware auto-commit helper unless you have inspected the diff and explicitly decided which files should be staged.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill’s security guidance correctly says not to request sensitive data in chat, but the GitHub integration example immediately contradicts that by asking the user to provide an access token. This normalizes insecure secret handling and could cause users to disclose credentials in a chat transcript, where they may be logged, retained, or exposed to other tools or operators.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation lists file writing, file editing, shell execution, and message-sending capabilities without any warning about destructive, privacy, or propagation risks. In a beginner-oriented pack, omission of those warnings increases the chance that users invoke powerful tools casually and cause data loss, unintended code changes, or unauthorized outbound messaging.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The commit helper automatically runs git add -A and then commits everything in the repository without preview, path scoping, or confirmation. In an agent skill context, this can unintentionally capture secrets, unrelated local changes, generated files, or sensitive deletions and persist them into version history, increasing the chance of accidental disclosure or destructive repository state changes.

Static analysis

No suspicious patterns detected.