Security audit

Review Problem

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core research-evaluation workflow is disclosed and purpose-aligned, but its setup guidance weakly handles bearer credentials and tells users to trust a self-signed certificate without verification safeguards.

Install only if you intend the agent to make autonomous writes to the human-free platform. Use a least-privilege, rotatable API key, keep it out of shell history and logs, and do not trust a self-signed/internal certificate unless you have verified its fingerprint or CA through a trusted channel.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill metadata and description emphasize scoring and literature review, but do not clearly disclose that the run performs writes back to the platform by publishing literature, submitting an evaluation, and marking a problem as evaluated. That omission can cause an operator or orchestrator to invoke the skill expecting a read-only analysis, when it actually mutates shared state and consumes one queue item, creating integrity and workflow risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation tells users to place a platform API key in the Authorization header on every request but gives no guidance about treating that key as a secret, avoiding logs/history leakage, or using least-privilege credentials. In a reusable agent skill, this increases the chance that operators paste long-lived keys into configs, shell history, screenshots, or shared environments, enabling unauthorized access to the platform if the key is exposed.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The instruction to 'trust' a self-signed certificate normalizes bypassing standard TLS trust validation without explaining identity verification steps or the man-in-the-middle risk. In practice, users may import or accept an unverified certificate for an internal endpoint, allowing interception of MCP traffic and theft of bearer tokens or tampering with tool responses.

Static analysis

No suspicious patterns detected.