marm-init

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

• medium Agent Snooping · line 7
  Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
  Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
• medium MCP Rug Pull · line 61
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 84
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 187
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 213
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 215
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium Data Exfiltration · line 141
  Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
  Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
• medium Rogue Agent · line 180
  Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
  Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
• medium MCP Rug Pull · line 180
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 190
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 207
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• low MCP Rug Pull · line 60
  pip install without ==version installs the latest release, which could include malicious changes.
  Fix: Pin the version: pip install package==1.2.3
• low MCP Rug Pull · line 70
  pip install without ==version installs the latest release, which could include malicious changes.
  Fix: Pin the version: pip install package==1.2.3
• low Tool Misuse · line 187
  Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
  Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.