Security audit

rabbit-writes

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed writing and prose-audit skill that can edit files and optionally use a configured model endpoint, so those modes should be used intentionally.

Install only if you are comfortable with a writing tool reading drafts you point it at and, when you explicitly choose write modes, modifying those files. Keep --apply-model local or verify the endpoint carefully before using it on private drafts, and understand that changing the active voice can affect later outputs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares no permissions while its documented behavior includes shell execution, file reads/writes, environment-variable access, and optional network access to model endpoints. That gap can mislead operators about the trust boundary and cause the skill to be enabled in contexts where users do not expect document contents or configuration to be modified or transmitted.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose frames this as a prose-writing skill, but the documented behavior extends into repository scanning, injection detection, CI/SARIF output, hook-driven rewriting, DOCX inspection, voice-profile management, and remote-model submission. This description-behavior mismatch increases the chance that users invoke a much more powerful skill than intended, exposing sensitive local files, changing content automatically, or sending text to external services under a seemingly narrow writing workflow.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The skill includes instructions to switch active voice profiles by modifying configuration state, which persists beyond the immediate task. In a writing skill, changing shared configuration can silently affect later outputs or other projects, especially where `.rabbit-voice` or `voices/ACTIVE` is reused across repositories or sessions.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The script can send document passages to an OpenAI-compatible external endpoint for rewriting. Even though it avoids sending the whole document and requires explicit flags, this still creates a real data-exfiltration/privacy risk if users process sensitive drafts, because selected passages may contain confidential or personal information and are transmitted off-host.

Vague Triggers

High

Confidence: 87% confidence
Finding: The activation language is extremely broad and overlaps with common requests such as emails, reports, chat messages, documentation, and 'make this sound like me.' Over-broad routing can cause this high-capability skill to trigger in many ordinary contexts, increasing exposure to file operations, automated rewrites, profile manipulation, and optional remote-model flows when a simpler, narrower skill would suffice.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation includes an in-place modification command (`--write`) without a strong warning at the point of use that it will overwrite files. In practice, users or calling agents may copy the command verbatim and alter source documents unexpectedly, which is risky for a skill operating on user-authored or repository-controlled text.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill recommends directly overwriting `voices/ACTIVE` to switch profiles without an explicit warning that this changes persistent configuration. That can unexpectedly alter future behavior across tasks or repositories and is especially sensitive because voice choice affects impersonation-style output and downstream rewriting decisions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code sends user-provided document text and sentence/paragraph spans to a model endpoint via `endpoint.complete(...)` without any explicit consent, warning, or policy enforcement in this module. In a writing-assistant skill, the transmitted content may include emails, incident writeups, personal correspondence, or other sensitive prose, so silent off-device disclosure is a real privacy and data-handling risk even if the code tries to minimize scope and gate outputs.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/rwlib/endpoint.py:54

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/injection.md:60