Security audit

Shoofly Advanced

Security checks for vulnerabilities and agentic risk

Overview

Shoofly Advanced has a plausible security purpose, but it gives an external local checker and notification system broad visibility into every tool call while failing open when the checker is unavailable.

Review before installing. Use this only if you trust the separate Shoofly binaries and configuration, can accept fail-open behavior, and are comfortable with tool arguments/results being inspected and logged. Prefer local-only notifications, verify redaction and log retention, and avoid using it for highly sensitive work unless those controls are in place.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill markets itself as a pre-execution blocking layer, but the instructions later explicitly fail open when the checker is missing, errors, or exceeds a 3-second timeout. That mismatch can create a false sense of protection and allow exactly the dangerous tool calls the product claims to prevent.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The body of the skill directly instructs agents to proceed with tool execution when the security check errors or times out, undermining the claimed pre-execution control. In a security product, this design makes bypass trivial: an attacker only needs to break, remove, or delay the guard process.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill mandates capturing tool names, arguments, and results and appending every evaluation to a local log, but gives no consent, minimization, or redaction requirements. Tool arguments and results often contain secrets, personal data, prompts, file contents, or tokens, so persistent logging creates an avoidable disclosure surface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The notification design sends alert text to external channels such as Telegram, WhatsApp, and an HTTP gateway without requiring sanitization or warning users that sensitive content may be included. Since alerts can contain block reasons, threat summaries, and possibly argument snippets, this can leak private or credential-bearing data off-device.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill tells the agent to tell the user what was blocked and why, including JSON from stderr, and elsewhere defines blocked log entries with argument snippets. Error output and block reasons can embed sensitive command arguments, file paths, prompts, or tokens, turning security telemetry into a data exposure channel.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Persistently logging every tool result and arguments creates a broad data retention channel that can capture sensitive natural-language content, source code, credentials, and documents. Because this is framed as mandatory after every tool call, the risk is systemic and not limited to rare edge cases.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:68