Security audit

Foreshadowing Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly performs foreshadowing tracking, but it includes an under-documented LLM script that can send full manuscript text to DashScope.

Review before installing if you work with private drafts. The documented local tracker appears purpose-aligned, but do not run scripts/track_foreshadowing_llm.py on confidential manuscript text unless you intentionally want that text sent to DashScope using your API key.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation advertises command execution and file/network-related capabilities but does not declare corresponding permissions. This creates a transparency and trust problem: users may invoke the skill without realizing it can read/write local files, access environment variables, and make outbound network requests, which can expose project data or secrets.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is local foreshadowing tracking, but the finding indicates the skill sends chapter text to an external DashScope service using an API key from environment variables. That mismatch is dangerous because users may provide sensitive unpublished manuscript content under the assumption of local-only processing, while the skill actually exfiltrates content to a third party.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The skill description suggests local foreshadowing tracking, but the implementation silently reads an API credential and transmits user chapter text to an external LLM service. This capability mismatch matters because users may provide unpublished manuscripts or sensitive drafts without realizing their content leaves the local environment.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script sends the full input text to a third-party API without an explicit warning, consent prompt, or privacy notice. In this skill context, the input is likely creative writing or unpublished chapters, so undisclosed external transmission can expose confidential content, copyrighted drafts, or sensitive personal material embedded in the text.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich PyYAML
Confidence: 91% confidence
Finding: The dependency `rich` is unpinned, so installs are not reproducible and may pull in unexpected future releases with breaking changes or newly introduced security issues. While this alone is not an immediate exploit, it weakens supply-chain control and can expose the skill to malicious or compromised upstream versions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich PyYAML
Confidence: 98% confidence
Finding: `PyYAML` is unpinned, which allows installation of arbitrary newer or older resolver-selected versions, including versions with known security flaws. Because PyYAML has a history of serious deserialization/input-validation issues, leaving it unpinned materially increases the chance of pulling a vulnerable build.

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

Category: Supply Chain
Confidence: 99% confidence
Finding: `PyYAML` has multiple known advisories, including deserialization and input-validation issues that can become severe if the skill processes untrusted YAML. Given this is an agent skill and such skills commonly ingest external or user-provided content/configuration, the presence of a known-vulnerable PyYAML dependency substantially increases risk of code execution or other compromise if unsafe loading paths exist.

Static analysis

No suspicious patterns detected.