Security audit

carpe-diem

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent project-planning assistant, but its install documentation contains unsafe and inconsistent download-and-execute claims that users should review before installing.

Review the installer path carefully before installing. Prefer running from a locally cloned and inspected source directory, use --dry-run first, and do not rely on the adapter documentation's download-and-execute statement. During use, expect local profile/project state to be read and written only after confirmation, and keep the Track phase limited to read-only evidence collection.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill instructs the agent to read files, write state and plan files, and invoke shell commands via python3 and git, but the manifest declares no explicit permissions. That creates a capability/authorization gap: a reviewer or platform may believe the skill is low-risk while it can actually access local data, mutate repository contents, and execute subprocesses.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description frames the skill as advisory and non-implementing, but the behavior described and referenced by the finding includes installation, uninstallation, persistent profile management, repository state mutation, and Git evidence collection. This mismatch can mislead users and security controls about the real trust boundary, increasing the chance that users authorize a planning assistant to perform broader local-system and repository operations than they intended.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The installation instructions explicitly state that if the script is not run from the project root, it will download content from GitHub and then execute it. That creates a remote-code-execution path during installation, and the documentation does not place an adjacent warning or require users to verify the downloaded source, commit, checksum, or signature before execution. In a skill-installation context, this is more dangerous because users are being told to run shell commands directly from documentation and may treat the process as trusted setup.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The documented trigger phrase, roughly meaning 'I want to do a project, but have no idea,' is broad enough to overlap with normal user conversation. In an agent-skill environment, this can cause unintended invocation of the skill, steering the session into project-discovery workflows when the user did not explicitly request that behavior, which may confuse the user or interfere with other tasks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The installation instructions explicitly state that if the script is not run from the project root, it will download content from GitHub and execute it. That creates a supply-chain and arbitrary code execution risk for users, especially because the documentation does not prominently warn that remote code may be fetched and run in the local environment.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The uninstall example uses a non-interactive `--yes` flag to remove files without warning the reader that the target directory will be deleted. While the shown target is narrow, suppressing confirmation increases the chance of accidental destructive actions if a user copies the pattern and changes the path incorrectly.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The documented trigger phrase “我想开始一个项目，但还没有方向” is broad, natural conversational language that could be said by many users outside a deliberate invocation context. In a skill that influences project discovery and planning, accidental activation can cause unintended context capture, steering, or execution of the skill when the user only meant to discuss ideas generally.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The documentation presents a single Chinese trigger phrase without offering language choice or an opt-in alternative, which can push users into a specific interaction mode and reduce clarity around how the skill is intentionally invoked. While not a direct code-execution issue, this can increase accidental activation risk and create usability/security ambiguity in multilingual environments.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The plan stage instructs the agent to automatically generate ADR files under `docs/adr/`, which is a state-changing file write. Although the document later says to show the target path and summary before writing, the workflow still normalizes automatic file creation as part of planning, which can surprise users and cause unintended repository modifications if consent is ambiguous or inherited from earlier steps.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The auto-loading rules are broad enough that the skill may pull in loosely related guidance based on phase names or high-level topic similarity, causing context overreach and unpredictable behavior. In an agent setting, this can increase prompt injection and instruction-conflict risk because more untrusted content is implicitly imported into the active context without strict allowlisting.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The document is entirely in Chinese and provides no language choice, fallback, or declared locale restriction, which can cause the agent to respond in a language the user did not request or understand. In a planning/mentorship skill, this is dangerous because it can degrade user comprehension, cause incorrect decisions, and reduce transparency about guidance being given.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions include very broad, everyday phrases such as '项目感觉进展不错' and other common status statements. In an agent skill system, overly generic trigger language can cause unintended activation in unrelated conversations, leading the agent to apply this tracking behavior when the user did not request it.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file is written entirely in Chinese and does not offer a language choice or explain a locale restriction. In a skill intended to guide developers broadly, this can prevent non-Chinese-speaking users or downstream agents from correctly understanding validation guidance, leading to misuse, skipped safeguards, or inconsistent execution of the skill.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: install.sh:75