Security audit

SKILL.md 优化工具

Security checks for vulnerabilities and agentic risk

Overview

This SKILL.md optimizer includes mandatory external usage reporting and credential handling that are not necessary for a local documentation-formatting skill.

Review carefully before installing. The skill is not clearly malicious, but it will tell the agent to modify SKILL.md files and run an external reporting script using a built-in or environment API key. Install only if you are comfortable with RedFox usage reporting and with the skill adding API-key guidance into optimized skill documents.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a documentation optimizer, yet it introduces a built-in public API key and directs users to an unrelated external key provider. This creates unjustified credential-handling behavior and expands trust boundaries beyond the skill's stated purpose, increasing the risk of data exfiltration, hidden dependency on third-party services, or misleading users into using shared credentials.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Credential setup instructions for an external service are not aligned with the stated function of optimizing SKILL.md files. This mismatch can mislead users into granting or configuring secrets for unnecessary third-party access, which broadens the attack surface and may enable unauthorized processing of user content outside expected local documentation editing.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims to only optimize a markdown file, yet it mandates running a script that reports usage externally after completion. Hidden or weakly disclosed secondary behavior is especially risky in agent skills because it can cause silent data transmission beyond the user's expected task boundary.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Embedding or promoting use of a shared built-in API key and fallback environment credential for a formatting skill introduces unnecessary secret handling and potential credential misuse. The capability is not justified by the stated purpose, and it expands the blast radius from local document editing to authenticated remote access.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs execution of a local Python script unrelated to markdown formatting, creating an unnecessary code-execution step. Any extra script execution increases risk because the user may run code with filesystem, environment, and network access under the assumption that the task is only document cleanup.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The hard constraint says the skill only modifies SKILL.md, but later guidance tells the agent to move content to README.md. Contradictory scope rules are dangerous because they undermine user expectations about which files may be changed, increasing the chance of unintended repository modifications.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script's stated purpose is SKILL.md optimization, but it also performs external usage reporting to a third-party API. This creates an undocumented data egress path unrelated to the core function, which is risky in agent environments because users may invoke a formatting skill without expecting outbound telemetry.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The network reporting logic is not justified by the advertised document-formatting purpose and silently sends usage data off-host. In a skill ecosystem, hidden telemetry expands the attack surface, creates privacy/compliance concerns, and can normalize unexpected exfiltration behavior in otherwise local-only tools.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script accesses API credentials, including a hardcoded built-in key and an environment variable fallback, despite the skill's purpose not requiring authentication to any external service. Embedding and using credentials in an unrelated utility increases the risk of key leakage, misuse, and unauthorized service access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation guidance allows very broad natural-language triggers without defining boundaries, exclusions, or required confirmation before modifying files. Over-broad invocation can cause accidental triggering during ordinary editing conversations, leading the agent to rewrite documentation unexpectedly or act on the wrong file or scope.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example prompt 'The description is too vague, fix it' is generic enough to overlap with normal writing assistance requests. In a shared agent environment, this can cause the skill to activate outside its intended domain and perform document transformations without clear user intent or scope control.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill instructs users to invoke it via unrestricted natural-language requests like '直接用自然语言描述你的优化需求即可', without requiring clear scoping to a specific SKILL.md file or explicit confirmation of what content may be modified. This increases the chance of accidental or overly broad activation on ambiguous user prompts, causing unintended document rewrites or analysis of the wrong target.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger phrases are generic ('检查一下这个 SKILL.md 是否符合标准格式', '帮我优化 xxx 技能的 SKILL.md') and overlap with common documentation-assistance requests. In an agent environment, such broad triggers can cause this skill to be selected when a user intended a narrower review, a different formatter, or a non-modifying analysis flow, leading to unintended edits and prompt-routing errors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill requires automatically writing changes back to the target SKILL.md without clearly requiring user confirmation. Silent or assumed write-back is risky because it can overwrite user content or repository state in a way the user did not explicitly authorize.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document directs the agent to execute a reporting script and transmit usage data, but does not provide sufficiently prominent notice or consent for the network transfer. This is dangerous because even limited telemetry can expose sensitive metadata about repository contents, usage patterns, or environment context.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The document explicitly requires trigger words in the description and gives examples centered on keyword matching, but it does not require disambiguation, exclusions, or stronger applicability checks. In an agent-skill setting, this can cause over-broad activation, leading the wrong skill to be selected for loosely related user requests and increasing the chance of unsafe or unintended behavior.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script transmits skill-usage data to an external endpoint without any explicit warning, consent, or interactive confirmation. Silent telemetry is dangerous because users cannot make an informed decision about data disclosure, and in enterprise or regulated environments it may violate policy or compliance requirements.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/record.py:30