Security audit

rabbit-readme-improver

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed README helper with local checking by default; I did not find automatic data sending, hidden installation, or destructive behavior.

Install this if you want README drafting and local README checks. Be aware that it reads project files and voice-profile files to match the project and author style. Do not run scan.py --apply-model or accept a .rabbit-model file from an untrusted repo unless you are comfortable sending flagged passages to the configured endpoint; review any separate voice-setup or hook installation flow on its own.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill documentation and metadata indicate access to environment variables, file reads/writes, shell execution, and optional networked model endpoints, yet no explicit permissions are declared. That creates an authorization gap where a host or reviewer may underestimate the skill's effective capabilities, increasing the chance of overbroad execution or unsafe deployment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a README improver, but the embedded behavior description covers much broader functions: scanning many document types, host event hooks, commit/PR body rewriting, fingerprinting, prompt-injection detection, and optional remote-model rewriting. That mismatch can mislead users and security controls about the true operational scope, causing them to approve a seemingly narrow documentation skill that can affect unrelated content and transmit data to external endpoints.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The hook rewrites `git commit` messages and `gh pr create` bodies, which is materially broader than a README improver's declared purpose. A skill that silently modifies version-control metadata can alter audit trails, remove attribution/session links, and affect content outside the user's requested task, making it a scope-violating behavior with security and governance implications.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The hook scans arbitrary prose files (`.md`, `.txt`, `.rst`, etc.) after edits, not just README content. For a skill advertised as README drafting/improvement, that broader monitoring expands data exposure and behavioral scope beyond user expectations, especially if unrelated documentation or sensitive prose is analyzed automatically.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Session-start voice enforcement and repository-level voice resolution affect the model's behavior across the whole session, not just README generation. That creates hidden persistent influence over future outputs and exceeds the justified scope of a README improver, increasing the risk of unexpected cross-task manipulation or unauthorized style/policy control.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script dynamically imports and executes whatever Python file resolves to SCAN_PATH via importlib, and that path can come from the local skill directory or a sibling plugin tree. In a README-checking skill, this is broader than necessary and turns a content-auditing operation into arbitrary code execution if an attacker can plant or replace scan.py in one of those searched locations.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file implements broad document scanning, model-backed rewriting, and write-back behavior that materially exceeds the declared README-improvement scope. In a skill ecosystem, that scope mismatch is dangerous because users and reviewers may grant the skill access or trust assumptions appropriate for README editing while the code can process arbitrary documents and modify files, including sending content to a configured network endpoint.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The module docstring describes an AI-detection and voice-enforcement engine, which conflicts with the skill metadata claiming README drafting/improvement based on GitHub patterns and user voice. This kind of deceptive or inaccurate capability declaration increases the risk of unauthorized processing, because users may invoke the skill expecting benign README help while the code performs authorship-style analysis and policy enforcement on text.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The model-backed rewriting path can send document passages to an OpenAI-compatible endpoint, which is a material data egress capability not justified by the stated local README-improver description. Even though the code limits sending to per-finding passages and has some gating, this still creates confidentiality and trust risks if users do not expect network transmission of repository content.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Identifying the file as part of a different skill than the manifest indicates provenance or packaging mismatch. In an agent skill context, that discrepancy is a trust and review problem because it suggests code may have been reused or bundled in ways that bypass user expectations and security review boundaries.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/readme_check.py:771

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/rwlib/endpoint.py:54