Security audit

Magic Docs

Security checks for vulnerabilities and agentic risk

Overview

This documentation skill appears useful, but it can automatically scan workspace content and persist conversation-derived information into Markdown files without tight user-selected scope.

Install only if you want a documentation helper that may update Markdown files automatically. Before using it, define exactly which files it may manage, avoid letting it read memory/tooling files with secrets or infrastructure details, and review diffs before accepting any generated updates.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases include broad natural-language requests like maintaining or creating a live document, which can cause the skill to activate when the user did not intend persistent auto-update behavior. In a skill that writes to files automatically, ambiguous invocation materially increases the chance of unauthorized or surprising workspace modifications.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The instructions say to scan the workspace and auto-update documents at the end of every conversation, but they do not impose strong consent, scope, or file-selection boundaries. This creates a durable automatic write path that can modify markdown files based on imperfect relevance judgments, making accidental data retention or document corruption more likely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description advertises auto-updating documentation but does not clearly warn that markdown files may be modified after normal conversations. Users may disclose information or continue chatting without realizing the skill may persist conversation-derived content into files, undermining informed consent.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to derive 'new information' from each conversation and persist it into documents automatically, which risks storing sensitive user-provided facts without deliberate review. Even with a rule not to write secrets, natural-language extraction is error-prone and can still retain confidential infrastructure details, internal decisions, or personal data.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The example explicitly tells the agent to extract existing device information from `MEMORY.md` and `TOOLS.md` into a document, encouraging cross-source aggregation of potentially sensitive operational data. Aggregating network and device details into an easily discoverable markdown file increases exposure and can transform partially protected information into a more valuable disclosure target.

Static analysis

No suspicious patterns detected.