Security audit

skill-evaluator-srl

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local skill-review tool that reads target skill files, runs a bundled scoring script, and writes disclosed reports, with no evidence of hidden data access or exfiltration.

Install this only if you want a local SRL-style skill evaluation workflow. Use explicit target paths, avoid broad batch evaluation in sensitive workspaces unless intended, and check before allowing report files to be written into repositories that may already contain .srl-report outputs.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill instructs the agent to read multiple files from a target skill directory, including SKILL.md, scripts, README, references, and _meta.json, but no explicit permissions declaration or user-facing scope limitation is present. This can lead to overbroad file access and weak consent boundaries, especially if the target path is user-influenced or resolves outside the intended skills directory.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase “检查 skill” is overly broad and can easily overlap with ordinary user requests, causing the skill to activate unintentionally. In an agent environment, false activation can redirect workflows, consume resources, or cause analysis of unintended targets, especially since this skill can inspect other skills and produce evaluative outputs.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The example “评估所有 skill” implies broad batch execution without documenting scope limits, confirmation steps, or exclusion rules. While this README alone does not prove dangerous automation, encouraging unrestricted bulk evaluation increases the risk of unintended large-scale actions, performance issues, or review of sensitive/internal skills beyond the user’s intent.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The description contains broad trigger phrases like '评估 skill', '检查 skill', and 'skill review', which can overlap with ordinary conversation and cause unintended invocation. Accidental triggering is risky here because the skill performs broad file reads and later writes reports, so a casual request could initiate nontrivial access and modification behavior without clear user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill directs writing `.srl-report.md` and `.srl-report.json` into the target skill directory without an explicit user-visible warning that files will be created or overwritten. This creates integrity and safety risks: unintended modification of repository contents, pollution of working trees, and possible overwrite of existing artifacts in paths derived from user input.

Static analysis

No suspicious patterns detected.