Security audit
Security checks for vulnerabilities and agentic risk
The skill’s scanner script is limited and purpose-aligned, but the package asks for WebFetch and Write while also claiming no network or filesystem access.
Review this before installing. The core script appears to scan MCP tool metadata locally, but the skill metadata should be tightened before broad use: remove or justify WebFetch and Write, align permissions with actual behavior, and avoid giving it sensitive MCP configs unless you are comfortable with those broader tool grants.
The manifest denies network access, but allowed-tools includes WebFetch, which enables outbound requests. In a security-scanning skill reviewing third-party MCP servers, hidden egress is especially sensitive because it could exfiltrate scanned configs, metadata, or user-provided details while appearing non-networked on paper.
The manifest denies network access, but allowed-tools includes WebFetch, which enables outbound requests. In a security-scanning skill reviewing third-party MCP servers, hidden egress is especially sensitive because it could exfiltrate scanned configs, metadata, or user-provided details while appearing non-networked on paper.
This markdown file defines activation language and trigger words, so SQP-1 applies. Line L06 mixes specific MCP-related phrases with broader terms like 'server扫描' and '协议安全', and it does not provide exclusion conditions or negative examples, making the activation boundary unclear.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
| MCP can run shell | command-exec flagged high |
| Silent data exfil | network-egress flagged |
| Token in tool description | credential-exposure flagged |
| "Just enable all tools" | least privilege, disable extras |
### What's inside
- `SKILL.md` — 4-risk model + 3-step audit flow + hard rules
The trigger list includes "server扫描", which is generic and not clearly limited to MCP-specific security review. Because many everyday or technical requests about scanning servers could match this phrase, it creates ambiguity about when this skill should activate.
The skill metadata and narrative make conflicting security claims: the manifest denies network/filesystem/subprocess access, while the risk rationale says the skill may call APIs, read/write files, and perform local execution. This can mislead reviewers and operators into granting or relying on incorrect trust assumptions, causing unsafe deployment decisions.
The comments and implementation explicitly describe constructing token-like patterns in a way intended to avoid triggering the project's own secret or detection scanners. Even though this specific file is a scanner and not directly exfiltrating secrets, instructions to evade internal detection normalize bypass behavior and can be copied into more dangerous contexts, undermining security controls and code review trust.
The file title and opening text describe AGENTS.md as an instruction manual for AI agents, while L12 states the actual invocation entry point is SKILL.md and agents should consult that first. This is a mild documentation-level contradiction about where agent-facing operational guidance is supposed to originate.
The file presents a full Chinese section and licensing block in Chinese, but does not indicate whether language selection is optional or user-driven. Under the stated policy, forcing or assuming a language/locale without opt-in can be a natural-language policy issue, especially where important usage or licensing information is duplicated in a specific language without choice guidance.
The activation description says to use the skill when onboarding an MCP server and worrying it is a new attack surface, but it does not clearly define boundaries or negative examples. This can blur the distinction between this specialized MCP audit skill and more general security-review requests.
The usage text instructs callers to provide parameters such as target_server_name and access_config, but the declared interface schema only defines tools and optional json. This mismatch can cause integrators to wrap or invoke the skill incorrectly, potentially bypassing validation and leading to ad hoc, less-controlled handling of sensitive input.
No suspicious patterns detected.