Security audit

catalyst-method-auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs a local catalyst-method audit, but it needs Review because its script can recursively delete any existing output directory chosen by the caller.

Before installing or using this skill, only run it with a dedicated empty output directory such as `outputs`; never point `--out` at a project folder, home subdirectory, shared workspace, or any directory containing files you need. Treat the MCP setup as an external-service integration and avoid sending proprietary experimental materials unless you understand the provider account, data flow, and retention terms.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The manifest positions the skill as a local method-auditing tool, but the body adds dependency on an external MCP platform for real-time retrieval and database-derived conclusions. This expands the trust boundary and data flow without clear disclosure in the primary interface, which can cause unanticipated transmission of sensitive research content to external services.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: For a skill whose stated purpose is reviewing catalyst preparation and evaluation plans, external database retrieval is not obviously necessary and may create unnecessary exposure of proprietary experimental methods. Pulling in external services beyond the minimum needed increases attack surface, privacy risk, and the chance of scope creep from document review into undisclosed data handling.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill unconditionally deletes the entire user-supplied output directory via recursive removal before generating reports. Because the path is fully user-controlled except for a root-directory check, a caller can cause destructive deletion of arbitrary directories such as project folders, home subdirectories, or shared workspaces, which exceeds the stated purpose of an auditing/reporting tool.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The docstring states outputs are written only to the selected output directory and that it is reset at start, but the implementation allows any resolved path to be passed and then recursively deleted. This mismatch is dangerous because it normalizes destructive behavior in documentation while hiding that the effective scope is not constrained to a safe app-managed workspace.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code performs recursive deletion of the selected output directory without any user-facing warning, confirmation, or dry-run safeguard. In practice this increases the likelihood of accidental destructive data loss, especially when users provide an existing directory path expecting files to be added or overwritten rather than the entire directory tree being erased.

Static analysis

No suspicious patterns detected.