Bird Watching Mode

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate bird-watching logger that stores and exports sightings, with privacy and CSV-sharing cautions but no hidden malicious behavior found.

Install only if you are comfortable with the skill keeping a local birding log that includes place, time, species, notes, and sometimes image paths or raw BirdID output. Review CSV files before sharing them, especially by email or spreadsheet, and treat the SuperPicky CLI dependency as a separate component you also need to trust.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_csv.py:95

Finding

Spreadsheet Formula Injection in CSV Exports

Content

View full analysis

Remediation

View remediation

str: text = "" if value is None else str(value) if text.lstrip().startswith(FORMULA_PREFIXES): return "'" + text return text ``` 2. Apply the function to every string written to both observation and summary CSV files: ```python writer.writerow([safe_csv_cell(row[k]) for k in OBS_FIELDNAMES]) ``` ```python w.writerow([ safe_csv_cell(species), len(by_species[species]), safe_csv_cell(first), safe_csv_cell(last), ]) ``` 3. Apply the protection to all exported fields, not only species and notes. Location names, timestamps, image paths, and data imported from existing `bird.json` files must also be treated as untrusted. 4. Add regression tests covering values beginning with `=`, `+`, `-`, and `@`, including values with leading whitespace and values exported through the summary path. 5. Document that exported CSV content is neutralized for spreadsheet safety. If preserving exact raw values is required, provide an explicit opt-in raw export mode with a security warning rather than leaving unsafe behavior as the default. 6. Consider exporting XLSX files through a library that explicitly stores untrusted values as text when spreadsheet compatibility is required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a user-facing bird-watching logging skill with location setup, region resolution, persistence, sighting recording, photo-based identification, and CSV export. The supplied code chunk does not implement that workflow. Instead, it is a unit test module for an identify_photo helper, checking that command arguments are formed correctly for different region types. While this is loosely related to one described feature (photo identify), it neither performs identification nor implements the broader logging/export workflow. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

**`$SKILL`** = directory containing this `SKILL.md` (usually `~/.myagent/skills/bird-watching-mode`). Before invoking anything, resolve it to an **absolute** pa

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to use shell, read environment variables, and read/write files, but it declares no explicit tool scope or permission boundaries. That increases the chance an agent runtime grants broader-than-necessary access or executes the workflow without clear user/admin review of its capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill persistently stores location, timestamps, species, notes, and possibly image paths or BirdID output in workspace/bird.json across the session. Persistent storage of user activity and location history creates privacy and retention risk, especially if the workspace is shared, synced, or later exported without minimization.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

## Purpose

1. **On enable**: Ask the user for **地点** (place name). Resolve **eBird region** with **superpicky-cli** `region-query`, then write **`workspace/bird.json`**.
2. **During use**: Either **identify a photo** (BirdID via scripts) or **record plain text** (species name). Always append **time** + **species** (and optional fields) to **`workspace/bird.json`**.
3. **Summary / export**: On request, run **`export_csv.py`** to produce CSV (and optional per-species counts), then **send the file or paste** to the user (chat attachment, email, etc.).

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs the agent to send exported CSV data through chat attachment or email without any warning, consent step, or sensitivity check. Bird logs can contain location, timestamps, notes, and image-path-related metadata, so exporting through external channels can disclose personal movement or other sensitive data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/identify_photo.py (reported line 99)May include surrounding context.

python

print("warning: bird.json has no region; running without -c/-r", file=sys.stderr)

    cmd = birdid_cmd_for_region(img, r, top=args.top, extra_args=list(args.extra))
    proc = subprocess.run(cmd, capture_output=True, text=True, check=False)
    if proc.stdout:
        sys.stdout.write(proc.stdout)
    if proc.stderr:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/set_region.py (reported line 38)May include surrounding context.

python

if not run_sh.is_file():
        raise FileNotFoundError(f"missing {run_sh}; set SUPERPICKY_CLI_SKILL or install superpicky-cli skill")
    cmd = [str(run_sh), "--region-query", query, "--json", "--limit", str(limit)]
    proc = subprocess.run(
        cmd,
        capture_output=True,
        text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill description hard-codes activation around the Chinese phrase '观鸟模式' alongside English wording, and later mixes Chinese-specific prompt terms for operation. This imposes a language/locale expectation without stating that users may choose their preferred language or that the locale constraint is intentional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The agent workflow instructs the skill to ask 'Where are you birding?' even though the document otherwise mixes Chinese and English. This is a natural-language policy concern because it prescribes a specific language for user interaction without opt-in or a stated regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script description says the CSV is for sharing and the code writes observation fields including notes, image paths, and location data to an output file. While the file-writing behavior is documented, there is no warning that the export may contain sensitive user or system-related data and may be persisted or shared unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.