Security audit

BrainHarness Cooking

Security checks for vulnerabilities and agentic risk

Overview

The cooking skill content is coherent, but it asks for file-writing, file-editing, and shell-command authority that a recipe helper does not need.

Review this before installing because the content is just cooking guidance, but the manifest grants broad local mutation and shell authority. If installing, prefer a pinned/reviewed release and consider removing Write, Edit, and Bash permissions unless you explicitly need them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (53)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad natural-language triggers and says it will infer intent automatically, which increases the chance of accidental invocation during ordinary conversation. In agent environments, overly broad routing can cause the skill to activate when the user did not explicitly request it, leading to unwanted context capture or inappropriate execution precedence over safer defaults.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 105)May include surrounding context.
在当前项目安装：

bash
mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 105)May include surrounding context.
在当前项目安装:

bash
mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The usage section presents common conversational phrases as direct invocations without clearly constraining when the skill should engage. This makes accidental activation more likely and can create prompt-routing ambiguity, especially in systems that auto-select skills from user utterances.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README is entirely in German and explicitly states a standard focus on 'lebendige, aber normale Sprache', implying a fixed language/locale for the skill experience. There is no indication that users may choose another language or that the German-only presentation is a documented, justified regional constraint.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_DE.md (reported line 67)May include surrounding context.
text
```bash mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_EN.md (reported line 71)May include surrounding context.
For the current project:

bash
mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: El archivo completo está redactado en español y no indica que el usuario pueda elegir otro idioma o locale. Según la política, forzar un idioma específico sin opt-in explícito constituye una posible violación de política lingüística.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_ES.md (reported line 67)May include surrounding context.
text
```bash mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documentation is entirely in Japanese and all example invocations and interaction guidance assume Japanese input, but there is no note that the skill is Japanese-only or that users may choose another language. This creates a natural-language locale constraint without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version. That causes execution of whatever version is current at install time, increasing supply-chain risk if the package changes unexpectedly or is compromised. In a skill-distribution context, install commands are security-sensitive because users may copy-paste them directly.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_JA.md (reported line 69)May include surrounding context.
現在のプロジェクトに入れる場合：

bash
mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_JA.md (reported line 69)May include surrounding context.
現在のプロジェクトに入れる場合:

bash
mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_KO.md (reported line 67)May include surrounding context.
text
```bash mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: O texto diz que a skill 'detecta automaticamente' intenções como 'o que você quer comer' e 'como fazer ou corrigir este prato', mas não delimita frases de ativação, contexto obrigatório nem exemplos negativos. Essas descrições são amplas e se sobrepõem a conversas culinárias comuns, o que pode causar invocações não intencionais.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README_PT.md (reported line 67)May include surrounding context.
text
```bash mkdir -p .claude/skills git clone https://github.com/zning1994/brainharness-cooking .claude/skills/brainharness-cooking

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents all usage instructions and behavioral description exclusively in Russian, with no indication that the user can choose another language. This can violate a language/locale policy when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add zning1994/brainharness-cooking without pinning the package version, which causes execution of whatever package version is current at install time. If the upstream package or a dependency is compromised, users may execute unexpected code during installation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.