Security audit

max-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because its default MAX search includes private notes and imported Google Drive documents without first checking that you want those sources included.

Require searches to stay within the chosen MAX profile and chat unless you explicitly request notes or Drive documents. Start with read-only permissions and approve history-download limits, background monitoring and remote changes explicitly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Conversation lookup, message retrieval, transcription, and monitoring are consistent with the declared messaging purpose. However, task lifecycle operations and administrative actions affecting membership or moderation are separate capabilities, not merely implementation details of reading and sending messages. Comments requiring owner authorization constrain these actions but do not make them declared capabilities. The supplied content is a command reference rather than execution evidence; the mismatch concerns the operations it explicitly exposes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Although the commands operate within the declared MAX environment, they expose contact-record and tagging management capabilities not described by the stated messaging purpose. In particular, modifying aliases, persistent notes, and tags constitutes additional user-facing functionality rather than merely supporting message retrieval or sending. Metadata inspection and synchronization alone would not establish a mismatch.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

The skill exposes remote group administration beyond its declared message-reading and sending purpose.

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The documented commands include adding and removing members, managing administrators, resetting invitation links, and accepting or declining membership requests. These change group membership and access rather than merely reading or sending messages, and the manifest does not declare group administration. Requiring an explicit owner request is a useful safeguard, but does not resolve the mismatch in advertised scope.
Content: No source excerpt is available for this finding.

The recommended default search includes imported Google Drive documents and local notes, beyond the declared MAX messaging scope.

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The instruction to begin with search all expands an ordinary MAX message search to local notes and imported Drive documents without first establishing that those sources are relevant or authorized. This can unnecessarily expose unrelated sensitive material to the agent and contaminate its answer; the owner-only output restrictions reduce onward disclosure risk but do not prevent excessive retrieval.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.