Security audit

Code Simplifier

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward code-cleanup helper that only asks the agent to review and simplify changed code before finishing work.

Install this if you want an agent helper that reviews recent code changes for reuse, complexity, and efficiency before wrapping up. Expect it to inspect diffs or modified files and make focused cleanup edits; review those edits as you would any automated code change.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description and usage note say to use the skill when code should be reviewed and cleaned up, and 'after making changes and before wrapping up.' These conditions are broad and lack explicit boundaries or exclusion cases, which could cause the skill to match many ordinary code-review or wrap-up requests rather than a narrowly defined invocation context.
Content: No source excerpt is available for this finding.