Security audit

Dog Train-O-Matic

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent dog-training plan generator with a local progress log, and I found no hidden, destructive, credential-seeking, or network behavior.

Before installing, understand that using the log feature saves training notes locally in the skill's scripts directory. Avoid putting sensitive household details in notes, and use the skill's referral warnings for aggression, bite history, severe anxiety, or deep fear instead of treating those as DIY training cases.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
`scripts/dog_trainer.py` combines three knowledge bases:

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/breed-drives.md (reported line 21)May include surrounding context.
md
dio - **Outlets:** bikejoring/canicross, flirt pole, weighted-pack hikes (adults), sanctioned digging pits, skijoring - **Expect:** howling, escape artistry (digging under, climbing over), hard pulling, prey drive - **Key insight:** huskies are engineered engines. Under-exercised = demolition. If you can't meet the floor honestly, choose another breed. ### SCENT HOUND (beagle, basset, dachshund, bloodhound...) - **Bred for:** following scent trails for hours - **Exercise floor:** 60 min, and *sniffing counts double* - **Outlets:** nose-work/hidden-treat searches, snuffle mats, scatter feeding, tracking long-lines - **Expect:** nose-to-ground pulling, "deaf" recall mid-trail, baying when bored, digging - **Key insight:** a 20-minute "sniffari" (dog chooses the route, sniffs everything) satisfies more than a 45-minute brisk march. ### SIGHT HOUND (greyhound, whippet, saluki, borzoi...) - **Bred for:** sprint-chasing - **Exercise floor:** 45 min; sprinters, not marathoners - **Outlets:*

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/dog_trainer.py (reported line 41)May include surrounding context.
python
dio - **Outlets:** bikejoring/canicross, flirt pole, weighted-pack hikes (adults), sanctioned digging pits, skijoring - **Expect:** howling, escape artistry (digging under, climbing over), hard pulling, prey drive - **Key insight:** huskies are engineered engines. Under-exercised = demolition. If you can't meet the floor honestly, choose another breed. ### SCENT HOUND (beagle, basset, dachshund, bloodhound...) - **Bred for:** following scent trails for hours - **Exercise floor:** 60 min, and *sniffing counts double* - **Outlets:** nose-work/hidden-treat searches, snuffle mats, scatter feeding, tracking long-lines - **Expect:** nose-to-ground pulling, "deaf" recall mid-trail, baying when bored, digging - **Key insight:** a 20-minute "sniffari" (dog chooses the route, sniffs everything) satisfies more than a 45-minute brisk march. ### SIGHT HOUND (greyhound, whippet, saluki, borzoi...) - **Bred for:** sprint-chasing - **Exercise floor:** 45 min; sprinters, not marathoners - **Outlets:*

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation advertises shell-based workflows and logging/plan adjustment behavior, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. That creates ambiguity about what the agent may invoke at runtime and can lead to over-privileged execution or unsafe shell/file-write access if the platform infers capabilities from examples or bundled code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill when the user asks for 'help with a behavior problem' or 'wants to know why their breed behaves a certain way,' which are broad natural-language triggers rather than a tightly scoped invocation condition. While the domain is dog-specific, the file does not provide exclusion conditions or negative examples in the activation text, increasing the chance of unintended invocation for general conversational pet questions.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_dog_trainer.py (reported line 89)May include surrounding context.
python
# ── CLI ────────────────────────────────────────────────────────────────────── print("cli:") r = subprocess.run([sys.executable, os.path.join(HERE, "dog_trainer.py"), "plan", "--breed", "corgi", "--age-months", "8", "--problems", "nipping", "--minutes", "25"], capture_output=True, text=True) check("plan cmd exits 0", r.returncode == 0, r.stderr)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_dog_trainer.py (reported line 96)May include surrounding context.
python
check("corgi → herding profile", "HERDING" in r.stdout) check("nipping protocol engaged", "Gentle mouth" in r.stdout) r = subprocess.run([sys.executable, os.path.join(HERE, "dog_trainer.py"), "breed", "greyhound"], capture_output=True, text=True) check("breed cmd works", r.returncode == 0 and "SIGHT HOUND" in r.stdout)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_dog_trainer.py (reported line 101)May include surrounding context.
python
check("breed cmd works", r.returncode == 0 and "SIGHT HOUND" in r.stdout) # log + today roundtrip (uses scripts/.trainlog.json) r = subprocess.run([sys.executable, os.path.join(HERE, "dog_trainer.py"), "log", "--step", "1", "--result", "success", "--note", "test"], capture_output=True, text=True) check("log cmd exits 0", r.returncode == 0, r.stderr)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_dog_trainer.py (reported line 105)May include surrounding context.
python
"--step", "1", "--result", "success", "--note", "test"], capture_output=True, text=True) check("log cmd exits 0", r.returncode == 0, r.stderr) r = subprocess.run([sys.executable, os.path.join(HERE, "dog_trainer.py"), "today"], capture_output=True, text=True) check("today shows logged entry", "success" in r.stdout and "test" in r.stdout) os.remove(dt.STATE_FILE)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_dog_trainer.py (reported line 110)May include surrounding context.
python
check("today shows logged entry", "success" in r.stdout and "test" in r.stdout) os.remove(dt.STATE_FILE) r = subprocess.run([sys.executable, os.path.join(HERE, "dog_trainer.py"), "demo"], capture_output=True, text=True) check("demo runs clean", r.returncode == 0 and "DEMO 4" in r.stdout)

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill persists session data to a local JSON file in the script directory, which creates a privacy and data-retention risk not clearly implied by a simple plan-generation tool. While the stored fields are limited, local persistence can expose user-provided behavior notes and usage history to other local users, backups, or later unintended reads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The logging command writes user-supplied notes directly to persistent local storage without any notice or consent flow. Even if not code-execution dangerous, free-form notes may contain sensitive personal details about household members, incidents, or routines, creating an unnecessary confidentiality risk.
Content: No source excerpt is available for this finding.