permission-priming

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

• high YARA Match · line 69
  YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
  Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
• high System Prompt Leakage · line 244
  Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
  Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
• medium Excessive Agency · line 248
  Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
  Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
• medium Rogue Agent · line 42
  Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
  Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
• medium Rogue Agent · line 49
  Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
  Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
• medium Rogue Agent · line 249
  Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
  Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
• low Privilege Escalation · line 134
  Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
  Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.