Security audit

file-organizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward file organizer that discloses its file-moving behavior and requires a dry-run plus confirmation before changes.

Before installing, treat this as a file-moving tool: use the dry-run preview, confirm the exact directory, avoid recursive mode unless you specifically want subfolders reorganized, and review the planned moves before approving execution.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description is broadly phrased around common tasks like cleaning up, sorting, and organizing folders, which creates a wide activation surface for an operation that can move large numbers of user files. Because the skill performs filesystem modifications, ambiguous triggering increases the chance it is invoked in situations where the user wanted advice, inspection, or a report rather than destructive reorganization.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The 'When to use' examples are open-ended and overlap with everyday requests like getting an overview of a folder or cleaning up documents, which may cause the skill to activate when a non-mutating response would be safer. In this context, the danger is elevated because the skill ultimately moves files and even advertises recursive operation, so mistaken activation could lead to unintended file relocation.

Static analysis

No suspicious patterns detected.