Security audit

Distill Self-Improving

Security checks for vulnerabilities and agentic risk

Overview

This skill organizes user-selected local files into a local knowledge base and does not show hidden network, credential, destructive, or background behavior.

Install this only if you want selected local files summarized into ~/.agent-knowledge. Avoid pointing it at folders containing secrets, private records, or regulated data unless you are comfortable with paths, metadata, and sanitized summaries being retained locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior emphasizes a read-only distillation workflow over user-specified files, but the skill also describes validator and self-test behaviors that can create or modify temporary fixtures and perform functionality not reflected in the user-facing description. This mismatch is dangerous because operators may authorize the skill under false assumptions about what it changes and when, reducing informed consent and making unexpected writes harder to detect.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
- 随包 `scripts/validate_collection.py` 是标准库只读校验器。先用 `describe` 查看机器契约；阶段用 `check --collection <目录> --gate G2|G3|G4|G5|G7`，单文件加 `--source <精确路径>`，失败用 `explain <co

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill appears to require file read and write capabilities but does not explicitly declare a tool scope or permission boundary. That creates an authorization ambiguity: a reviewer or runtime may underestimate what the skill can do, increasing the chance of unintended file modification within the local knowledge base or other accessible paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language description is written entirely in Chinese and presents the skill behavior and user-facing process as fixed, with no indication that the user may choose another language. Under the policy, forcing a specific language without opt-in is a locale/language violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown template uses Chinese headings and instructions throughout, which imposes a specific language for the skill output. The file does not indicate that language selection is optional or configurable, so it creates a locale/language policy concern under the natural-language policy rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template uses Chinese section titles and labels throughout, which imposes a specific language on the skill output. The file does not offer an opt-in choice of language or document any justification for a Chinese-only locale, matching the policy-violation criteria for language or locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire template is written in Chinese and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill guidance is written in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This Python file contains user-facing natural-language text in Chinese from the module docstring onward, and the CLI exposes that text via argparse descriptions and help output. The stated policy forbids forcing a specific language without user opt-in, and this file provides no mechanism to select another language or locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple argparse help strings and runtime error messages are hard-coded in Chinese, which means normal interactive use of the tool is constrained to one language. Because the file does not offer a locale switch or documented opt-in, this is a natural-language locale policy violation under the provided rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template uses Chinese section headings and instructions, which can impose a specific language on users without any visible opt-in or explanation. Under the policy, forcing a language or locale without user choice is a natural-language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown template includes section headings and instructions in Chinese alongside English terms, which can impose a language/locale expectation on users filling out the template. The file does not state that Chinese is required, nor does it offer an alternative language option or opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.