Security audit

Convert Natural Language

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it should be reviewed because it can generate executable, database, and API actions and suggests using environment auth tokens without tight scoping.

Install only if you are comfortable reviewing generated SQL, shell commands, and API requests before use. Treat Authorization headers and API keys as sensitive: prefer placeholders or user-supplied test tokens, and do not let an agent automatically execute generated commands or send generated API calls without explicit confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code’s primary function is unrelated to natural language conversion. It performs QA/lint-style checks on a skill repository and its markdown metadata, plus scans for possible secrets and required files. None of the observed behavior implements parsing user text into SQL/JSON/API requests/search queries/regex or any other structured output. This is a material description-behavior mismatch because the actual capability is a compliance/test suite for skill packaging, not a conversion skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README leaves the trigger condition as a placeholder ('When triggered: [trigger condition]'), so users and orchestrators do not have a clear activation boundary for the skill. In an agent system, ambiguous invocation criteria can cause the skill to run in unintended contexts and transform user input into machine-readable commands or queries without appropriate scoping, increasing the risk of misuse or unsafe downstream actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises a '--mode write' operation with an input file but provides no warning about whether the command mutates files, overwrites outputs, or emits commands/data that may be acted on automatically. For a skill that converts natural language into structured commands or data, undocumented write behavior can lead to accidental data modification, unsafe automation, or user trust in outputs that may require validation before execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown file falls under the vague-trigger category, and the invocation guidance at L13 uses a generic placeholder instead of concrete trigger phrases or activation constraints. Without specific triggers or exclusions, users and orchestrators cannot tell when the skill should or should not be invoked.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation presents the skill as operating in generic "read" and "write" modes, including writing an input JSON file, which contradicts the manifest's intent of converting plain-language input into structured outputs like SQL, JSON, or API requests. This is not just incomplete documentation; it describes a different interaction model centered on file I/O modes rather than language conversion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: For markdown files, warnings are expected when the skill may affect user data or system integrity. The usage example includes a 'write' mode with an input file, but the document provides no caution about file modification, overwrite behavior, or other data-impacting effects.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly supports converting natural language into shell or CLI commands, which can bridge untrusted user input into executable system actions. Even though the markdown warns against destructive commands, command generation materially increases the risk of producing harmful or privilege-sensitive operations, especially if a downstream agent executes the output automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The test explicitly requires a file named README_zh.md, which imposes a specific language/locale expectation. The file does not indicate that this is optional, user-selected, or justified as a region-specific requirement, so it appears to violate the language/locale policy.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file defines _main() twice, and the second definition overrides the earlier test-runner implementation. Because the if __name__ == '__main__': sys.exit(_main()) call appears before the redefinition, direct script execution still uses the first _main, but any later import-and-call or tooling that resolves _main from the module will hit the broken replacement calling undefined _run_unit_tests(), causing runtime failure and contradicting the documented entrypoint behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file explicitly states 'Keep SKILL.md body in English,' which is a natural-language policy constraint. Under the policy rules, forcing a specific language without opt-in or a documented regional/compliance justification is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The line 'SKILL.md body must be in English; reference docs in English' enforces a specific language for documentation. This is a natural-language locale restriction and the file does not offer contributor choice or provide a documented justification for the requirement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest describes a skill for converting natural-language descriptions into structured formats, which does not inherently require external service access. Declaring a mandatory API_KEY suggests dependence on an external API capability that is not justified or explained by the stated purpose in the provided documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Line L080 contains the Chinese term "排序" inside otherwise English operational guidance. This creates an implicit language inconsistency and may violate a language/locale policy when the skill does not offer any user choice or document multilingual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This test walks the tests directory and opens every file to scan contents for secret patterns. For code files, reading file contents that may include sensitive data should have some visible disclosure such as a comment, docstring, or user-facing notice; this file contains no warning near the recursive read operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.