AI Opportunity Navigator

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 3:10 AM UTC
• Version: 1.0.0

Overview

This skill coherently helps compare public freelance opportunity pages against a user profile, with disclosed local filtering and no evidence of hidden persistence, credential use, applications, purchases, or data exfiltration.

Before installing, be aware that live verification will contact public opportunity websites and that the optional human review/payment flow is separate from the free skill experience. Do not provide credentials, identity documents, payment details, or submit applications through the skill; treat job availability, approval, and earnings as unverified until confirmed on the original sites.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to read a local file and run a shell command (python3 scripts/match.py --profile - --live) but does not declare any tool scope such as permissions or allowed-tools. That creates a least-privilege gap: a host may permit broader file or shell access than the skill actually needs, increasing the chance of unintended command execution or file access if the skill or adjacent content is modified or abused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring says 'No credentials, telemetry or personal-data transmission,' which reads as a strong no-transmission claim. In live mode, the code performs external HTTP requests with curl to each opportunity source URL; while it does avoid sending the user profile, it still transmits network metadata and contradicts an absolute 'no ... transmission' statement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/match.py (reported line 16)May include surrounding context.

python

def live_check(op):
    try:
        r = subprocess.run(['curl', '--silent', '--show-error', '--location', '--max-time', '12',
                            '--max-filesize', '600000', '--user-agent', 'OpportunityNavigator/1.0 public-page-check',
                            '--write-out', '\n%{http_code}', op['source_url']],
                           capture_output=True, text=True, timeout=15)

Static analysis

No suspicious patterns detected.