Security audit

Dev Mentor

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only development mentoring skill with disclosed project tracking and deployment guidance, not evidence of hidden or malicious behavior.

Before installing, know that the skill may create a local dev-mentor-projects.json file containing project descriptions, issues, todos, and optional server summaries. Avoid putting secrets in those notes, delete the file when you no longer want retained context, and use the deployment advice as learning guidance rather than live production incident instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the skill is not for production troubleshooting, yet the instructions include operational debugging such as checking 502s, API timeouts, logs, process management, monitoring, backups, and launch maintenance. This scope expansion can cause the agent to provide risky production operations guidance in contexts it was supposed to avoid, increasing the chance of unsafe actions on live systems.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill claims it is not for onboarding existing mature projects, but it instructs users to switch back to prior projects, load saved state, and modify previously built systems such as adding logging. That broadens the skill into ongoing maintenance and partial onboarding of existing projects, which can bypass the intended boundary and lead the agent into higher-risk advice on systems it did not build from scratch in the current session.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The listed triggers include broad phrases such as "学开发", "从零做项目", "教我做项目", "带我开发", "coding mentor", and "dev companion", which can match many general conversations rather than a narrowly scoped skill invocation. Although a short NOT-for list is present, the trigger scope is still broad enough to risk unintended activation outside the intended mentoring context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes persistent project-state creation without a clear upfront warning in the user-facing behavior that local data will be stored. Users may disclose project details assuming a normal conversational interaction, while the skill quietly shifts into retention of natural-language content and environment details.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs creating and updating a persistent local JSON file containing project metadata, issues, todos, and server-related information across sessions. For a mentoring skill, this creates unnecessary durable storage of user-provided content and system details, increasing privacy, retention, and unintended disclosure risk beyond what is needed for immediate tutoring.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prescribed JSON state file stores user project descriptions, feature lists, issues, todos, and server information in natural language across sessions. This creates a clear data-retention surface where sensitive business context, credentials-adjacent notes, or infrastructure details may accumulate and later be exposed to other users, tools, or processes on the same environment.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to automatically read prior session state whenever a user mentions an earlier project, encouraging resurfacing previously stored user data without renewed consent or context verification. This increases the risk of overexposure of historical notes, operational details, or sensitive project information when references are ambiguous or shared environments are involved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.