Security audit

Iknowkungfu

Security checks for vulnerabilities and agentic risk

Overview

This is a local, read-only recommendation skill, but it asks to read broad private agent history and scan all installed skill files without enough scoping or isolation.

Install only if you are comfortable with the skill reading your agent memory, recent logs, configuration, schedules, and installed skill directories. It does not show evidence of writing files or sending data out, but users should run it in a limited workspace or after reviewing what local history and skill files it can access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:22
Finding: Overbroad Access to Sensitive Agent State and System-Wide Skill Files
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/workflow-analysis.md:19
Finding: Untrusted Installed-Skill Content Is Loaded Without Prompt-Injection Isolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/workflow-patterns.json (reported line 61)May include surrounding context.
json
"security": { "keywords": ["password", "credential", "encrypt", "vault", "audit", "vulnerability", "backup", "2FA", "SSH", "key", "secret", "scan", "malicious", "injection"], "tools": ["bitwarden", "1password", "dashlane", "virustotal", "snyk"], "file_patterns": [".env", "*.pem", "*.key"], "skill_indicators": ["clawspa", "1password", "arc-security-audit", "azhua-skill-vetter", "agentguard"] }, "media": {

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The catalogue advertises skills with broad, generic activation cues and high-capability actions, which can cause over-selection or unintended invocation of powerful skills in ambiguous contexts. In a discovery engine, this raises the chance that an agent recommends or routes toward tools with write or network permissions without sufficiently precise user intent, increasing the risk of accidental unsafe actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This manifest enumerates many skills with filesystem write and network outbound permissions, but provides no user-facing warnings, sensitivity labels, or privacy-impact disclosures. In a skill discovery context, that omission can normalize installation or recommendation of high-impact capabilities without informing users that selected skills may modify local data, access external services, or expose sensitive information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The research pattern includes very generic terms such as 'search', 'find', 'compare', and 'analyze', which are common in normal conversation and can cause the discovery engine to classify unrelated requests as research-oriented. In a skill that recommends additional capabilities, this can lead to unnecessary or inappropriate skill suggestions and broaden the agent’s effective behavior in ways the user did not intend.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The productivity pattern uses broad words like 'task', 'project', 'plan', and 'meeting' that appear in many non-productivity contexts. Because this skill is a discovery engine, ambiguous matching can trigger recommendations for productivity integrations even when the user is discussing something else, creating unintended activation and possible overreach into calendars, task managers, or planning workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Automation keywords like 'automate', 'trigger', 'workflow', and 'bot' are ambiguous and can describe many ordinary discussions rather than a real need for automation tooling. In this skill’s context, that ambiguity can cause the engine to over-recommend high-capability automation skills, increasing the chance of users enabling unnecessary integrations or autonomous behaviors.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The maintenance pattern contains vague terms such as 'health', 'audit', 'cleanup', and 'backup', which overlap heavily with routine system, business, and general support discussions. This can make the discovery engine infer maintenance needs too broadly and recommend sensitive housekeeping or self-management skills that alter agent state or retained context without clear user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as a recommendation/discovery engine, but its workflow explicitly instructs the agent to enumerate installed skills and inspect all files in those directories for suspicious patterns. That expands access from metadata-based recommendation into broad local file inspection, increasing privacy exposure and creating an unnecessary capability to read unrelated skill contents under the guise of analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file switches from English to Simplified Chinese for a full duplicate section, but does not state whether language is user-selectable or whether the skill is intended for a China-specific audience. Under the policy rule, locale/language constraints should be optional or clearly justified rather than implicitly imposed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.