Mirofish

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 3:59 PM UTC
• Version: 0.1.1

Overview

This is a mostly offline planning skill with optional local backend documentation, but users should be careful with the live-backend API references because they include destructive endpoints.

Install is reasonable for offline forecasting and planning. Only use the live backend mode if you intentionally operate a MiroFish backend, understand what files will be uploaded, and review any reset/delete actions before allowing an agent to run them.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented API surface exposes broad backend capabilities, including creation, execution, reset, deletion, and live status operations that exceed the stated purpose of an offline workflow-authoring skill. This mismatch increases the chance that an agent using the skill could invoke real state-changing services or leak into unintended operational control paths.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Endpoints for starting, stopping, closing environments, and checking runtime status provide direct operational control over simulations, which is not justified by a skill described as building workflows offline. If an agent is allowed to act on this documentation, it could trigger or disrupt backend jobs and environments rather than merely generating planning artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The graph deletion capability is destructive and unnecessary for an offline authoring workflow. Documenting such an endpoint in the skill increases the risk that an agent or user could remove project data by mistake or through prompt-driven misuse.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as an offline workflow tool, but this runtime contract directs operators to connect to a live backend and specifies concrete network endpoints, polling behavior, and operational recovery steps. That mismatch can cause unintended network access, data exfiltration of uploaded materials, and unsafe operator assumptions about the trust boundary, especially when users expect purely local processing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Reset and delete endpoints are listed without any warning, confirmation requirement, or note about destructive consequences. In agent-facing documentation, omission of such safety context makes misuse more likely because the operations appear equivalent to harmless read actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The report deletion endpoint is presented without any indication that it permanently removes resources. That lack of safety framing is risky in an agent-oriented skill because agents may treat the endpoint as routine maintenance and delete outputs unintentionally.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/graph/task/<task_id>`
- `GET /api/graph/tasks`
- `GET /api/graph/data/<graph_id>`
- `DELETE /api/graph/delete/<graph_id>`

## Simulation

• Confidence: 88% confidence
• Finding: A delete endpoint parameterized by graph_id can be abused if an agent is induced to supply attacker-chosen or unvalidated identifiers. In the context of a skill that should only help build offline workflows, exposing parameterized destructive operations significantly increases the risk of unauthorized or accidental deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/report/by-simulation/<simulation_id>`
- `GET /api/report/list`
- `GET /api/report/<report_id>/download`
- `DELETE /api/report/<report_id>`
- `POST /api/report/chat`
- `GET /api/report/<report_id>/progress`
- `GET /api/report/<report_id>/sections`

• Confidence: 88% confidence
• Finding: A parameterized report deletion endpoint creates a tool-parameter abuse path where an agent could be prompted to delete arbitrary reports by ID. Because the skill claims an offline planning purpose, the presence of such an operational endpoint is especially dangerous and unjustified.

Static analysis

No suspicious patterns detected.