Security audit

Nlp

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent local NLP tool, but one summarization option can be abused to run arbitrary shell commands.

Review before installing. Use this only in a constrained environment or after the --ratio handling is fixed to validate numeric input and pass it to AWK as data. Do not feed confidential or regulated documents unless local processing is approved, and treat --json output as untrusted until proper escaping is implemented.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:382
Finding: AWK Command Injection Through the Summarization Ratio
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:285
Finding: Unescaped User-Controlled Data Produces Invalid or Manipulated JSON
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code substantially matches the declared NLP purpose for tokenizing, sentiment, extraction, summarization, and similarity. However, it also exposes an additional command, 'classify', which performs text classification and is not mentioned in the declared description. That is an undeclared capability under the evaluation criteria. Additionally, the script can read from local files via --file/--file1/--file2, while declared permissions are empty; this is a resource access inconsistency if permissions are expected to enumerate file access. The primary purpose remains NLP, so this is not a wholly different skill, but the description is not fully accurate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The extract command explicitly pulls out emails, URLs, dates, numbers, and capitalized names from arbitrary user-supplied text, which can include personal or sensitive data. In an agent skill context, this increases privacy risk because the tool encourages structured extraction of PII without any consent notice, minimization controls, or guidance on safe handling, making downstream misuse or overcollection more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This skill is designed to process arbitrary user text from files and stdin, including emails, reports, and articles, yet it provides no privacy warning about handling sensitive content. While the skill claims to be stateless and local, users may still unintentionally pass confidential data, creating avoidable privacy and compliance risk through insufficient disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.