Security audit

Skill Taxonomy Router

Security checks for vulnerabilities and agentic risk

Overview

This skill is a useful routing policy, but it tells agents to run missing relative-path scripts for logging, downloading, indexing, and deleting files, which should be reviewed before installation.

Install only if you are comfortable with a meta-skill influencing future skill selection. Do not run the documented scripts unless you have the actual trusted helper implementations, verify they resolve from the skill package rather than the current project directory, and configure logging to avoid storing sensitive prompts or customer details.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:167
Finding: Untrusted Relative-Path Execution of Missing Helper Scripts
Content: View full analysis
--domain <...> --subdomain <...> --risk <...> --skills [--candidates ...] [--reason ...]`. - Direct usage-only fallback: `python3 scripts/track_skill_usage.py mark [...]`. - To see high-frequency skills, run `python3 scripts/track_skill_usage.py report --limit 30`. ``` ```markdown - Use `python3 scripts/intake_skill.py ` for high-automation intake. - This checks overlap against the organized skill set, downloads into `~/Desktop/skills-inbox` only when appropriate, and records intake state for later review. Use `python3 scripts/cleanup_download_inbox.py --yes` to remove the Desktop inbox folder after the import batch is fully processed. ``` ```markdown - `scripts/update_skill_index.py`: rebuilds the installed-skill index from current skills - `scripts/cleanup_download_inbox.py`: deletes the Desktop inbox folder after a batch is fully processed - `scripts/review_risk_sources.py`: generates a review list using source/risk signals - `scripts/check_download_overlap.py`: checks a candidate download against the existing organized/classified skill set - `scripts/intake_skill.py`: high-automation intake that checks overlap, downloads to inbox, and records intake state - `scripts/track_skill_usage.py`: marks ...[truncated 3296 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:167
Finding: Default Persistent Logging of Potentially Sensitive Task Metadata
Content: View full analysis
--domain <...> --subdomain <...> --risk <...> --skills [--candidates ...] [--reason ...]`. - Treat this as the default route-post action, not an optional extra, whenever a skill is clearly used. - This both records the routing decision and increments usage counts for the chosen skills. - Direct usage-only fallback: `python3 scripts/track_skill_usage.py mark [...]`. - To see high-frequency skills, run `python3 scripts/track_skill_usage.py report --limit 30`. ``` ```markdown - `references/usage-stats.json`: usage counters for skills chosen in practice - `references/routing-decisions.jsonl`: append-only routing decision log ``` ### Technical Analysis The Skill makes routing-decision logging the default and permits free-form `intent` and `reason` values. These values can contain user prompts, project names, customer information, incident details, or other confidential task context. The specified destination is an append-only JSONL log, indicating persistent accumulation. The policy does not define: - User consent or an opt-out mechanism. - Data-minimization requirements. - Redaction of credentials, personal information, or confidential content. - ...[truncated 1910 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
Treat this routing policy as persistent guidance for future tasks. Reuse it by default whenever deciding whether to load a skill. ## Update policy Update this skill when one of these happens: - a new cluster of downloaded skills appears - a subdomain becomes crowded and needs splitting - a skill was misrouted in practice

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
## Boundaries - Do not load a high-risk skill when a lower-risk path can complete the task. - Do not treat installation/update skills as defaults. - Do not let broad agent or meta skills overshadow narrow purpose-built skills. - Do not permanently trust unreviewed new skills; classify them first. - Do not allow newly downloaded skills to perform risk operations unless the user explicitly agrees.

Static analysis

No suspicious patterns detected.