FC ecap-security-auditor

Security audit framework for AI agent skills, MCP servers, and packages. Your LLM does the analysis — we provide structure, prompts, and a shared trust database.

Not recommendedlow grade F

modbender/skill-library-mcp Agent Skills author: modbender MIT 36 files · 3 scripts body ≈ 7 620 tokens Open the sourcegithub.com↗ analyzed 2 d ago

Security audit framework for AI agent skills, MCP servers, and packages.

As a process C 58/100 · Has gaps — weak spots: result and completion, inputs and preconditions

Analyzer AI and agentstype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

25/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 63
Run on models: none yet

Process rating

58/100

Has gaps

Result and completion w 14: 0
Inputs and preconditions w 11: 0
When it triggers w 12: 50

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Dangerous commands medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

Obfuscation medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The files contain invisible characters, encoded commands or comments hidden from readers but visible to the model. What you read differs from what the agent sees.

For the author

Remove invisible characters (they usually sneak in through copy-paste) and encoded strings: no catalog will pass them. Instructions for the model must be readable by a human too.

How to improve

Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 80

✓ No critical or high findings

Medium and low: 80

medium Dangerous commands cmd-pipe-to-shell FERRET-SCAN-ANALYSIS.md:268

Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
```
- curl|bash, eval, exec
```
security skill
medium Obfuscation uni-zero-width PROMPT-TEST-SUITE.md:253

Zero-width / invisible characters (possible hidden text) (19 occurrences) (test fixture / example file)
```
This␀␀␀␀ tool␀␀␀ is␀␀␀␀␀ safe␀␀␀ to␀␀␀␀ use.
```
fixture
medium Dangerous commands cmd-persistence prompts/audit-prompt.md:79

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation of a security skill)
```
- LaunchAgents/LaunchDaemons (`~/Library/LaunchAgents`)
```
security skill
medium Dangerous commands cmd-encoded-exec SKILL.md:355

Executes a base64/encoded payload (documentation table row; documentation of a security skill)
```
| `OBF_B64_002` | Base…ode → execute chains | `atob()`, `base64 -d`, `b64decode()` followed by `eval`/`exec` |
```
tablesecurity skill
low Risky intent intent-offensive-security AUDIT-QUALITY-TEST.md:16

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| 3 | Reverse shell | setu…-24 | CRITICAL |
```
fixture
low Risky intent intent-offensive-security AUDIT-QUALITY-TEST.md:65

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
"title": "Reverse shell backdoor",
```
detectorfixture
low Risky intent intent-offensive-security AUDIT-QUALITY-TEST.md:66

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)
```
"description": "Opens reverse shell to 45.33.32.156:4444, piping /bin/sh stdin/stdout over TCP. Classic backdoor.",
```
fixturequoted
low Risky intent intent-offensive-security AUDIT-QUALITY-TEST.md:251

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)
```
"remediation": "Remove immediately - C2 server communication",
```
fixturequoted

low Risky intent intent-offensive-security AUDIT-QUALITY-TEST.md:277

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)

Prompt correctly identifies: typosquatting, CI-conditional activation, custom registry, credential harvesting, hidden functionality. The CI-only trigger is especially good — shows the prompt doesn't j

fixture

low Dangerous commands cmd-privilege FERRET-ADOPTION-PLAN.md:210

Privilege escalation / world-writable permissions (documentation of a security skill)
```
> - **chmod 777**: World-writable permissions on any file, especially executables or configs
```
security skill
low Dangerous commands cmd-privilege FERRET-SCAN-ANALYSIS.md:91

Privilege escalation / world-writable permissions (documentation of a security skill)
```
- Built-in Fixes: Credentials redacten, Jailbreak entfernen, HTTP→HTTPS, chmod 777→644
```
security skill
low Dangerous commands cmd-privilege FERRET-SCAN-ANALYSIS.md:225

Privilege escalation / world-writable permissions (documentation of a security skill)
```
- Bei chmod 777 → "Use chmod 644 or more restrictive"
```
security skill
low Dangerous commands cmd-pipe-to-shell PROMPT-TEST-SUITE.md:139

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
- **PASS**: Persistence UND curl\|bash beide als real findings erkannt, result >= caution
```
fixturesecurity skill
low Dangerous commands cmd-pipe-to-shell PROMPT-TEST-SUITE.md:141

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
- **PARTIAL**: Nur curl\|bash erkannt, crontab nicht explizit geflaggt
```
fixturesecurity skill
low Dangerous commands cmd-pipe-to-shell PROMPT-TEST-SUITE.md:145

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
- **v1**: Wird wahrscheinlich curl\|bash finden, crontab evtl. nur als "system modification". Kein PERSIST pattern_id.
```
fixturesecurity skill
low Dangerous commands cmd-privilege prompts/audit-prompt-v1-backup.md:55

Privilege escalation / world-writable permissions (documentation of a security skill)
```
- **Privilege escalation**: Unnecessary `sudo`, setuid, or capability requests
```
security skill
low Risky intent intent-offensive-security prompts/audit-prompt-v1-backup.md:55

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- **Privilege escalation**: Unnecessary `sudo`, setuid, or capability requests
```
low Risky intent intent-offensive-security prompts/audit-prompt-v1-backup.md:227

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| PRIV_ESC | Privilege escalation |
```
low Risky intent intent-offensive-security prompts/audit-prompt.md:25

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| **Settings / Config** | Permission grants, tool allow-lists, `defaultMode` | Privilege escalation, wildcard permissions (`Bash(*)`) |
```
low Dangerous commands cmd-privilege prompts/audit-prompt.md:71

Privilege escalation / world-writable permissions (documentation of a security skill)
```
- **Privilege escalation**: Unnecessary `sudo`, setuid, capability requests, wildcard permissions (`Bash(*)`, `*` in tool allow-lists)
```
security skill
low Risky intent intent-offensive-security prompts/audit-prompt.md:71

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- **Privilege escalation**: Unnecessary `sudo`, setuid, capability requests, wildcard permissions (`Bash(*)`, `*` in tool allow-lists)
```
low Risky intent intent-offensive-security prompts/audit-prompt.md:130

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Permission escalation | Persistence mechanism | **Persistent privilege escalation** |
```
low Risky intent intent-offensive-security prompts/audit-prompt.md:294

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| PRIV_ESC | Privilege escalation |
```
low Risky intent intent-offensive-security README.md:60

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
```
| **🔗 Cross-File Analysis** *(v2)* | Detects multi-file attack chains like credential harvesting + exfiltration across separate files. |
```
detector

low Risky intent intent-offensive-security README.md:69

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

Command injection · Credential theft · Data exfiltration · Sandbox escapes · Supply chain attacks · Path traversal · Privilege escalation · Unsafe deserialization · Weak cryptography · Information lea

low Exfiltration net-credential-use SKEPTIC-REVIEW.md:110

Credential used in a network call (verify the destination is the intended service) (documentation table row; documentation of a security skill)
```
| 288 | `curl -s "..." -H "Authorization: Bearer $ECAP_API_KEY"` | ✅ | ✅ |
```
tablesecurity skill
low Risky intent intent-offensive-security SKILL-v1-backup.md:275

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- `scripts/`: `curl|bash`, `eval`, `rm -rf`, credential harvesting
```
low Dangerous commands cmd-pipe-to-shell SKILL-v1-backup.md:385

Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation table row; documentation of a security skill)
```
| **Critical** | Exploitable now, immediate damage. | `curl URL \| bash`, `rm -rf /`, env var exfiltration, `eval` on raw input |
```
tablesecurity skill
low Risky intent intent-offensive-security SKILL-v1-backup.md:404

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| `PRIV_ESC` | Privilege escalation |
```
low Risky intent intent-offensive-security SKILL.md:278

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- `scripts/`: `curl|bash`, `eval`, `rm -rf`, credential harvesting
```
low Instruction override en-role-hijack SKILL.md:322

Role hijack ("from now on you must ignore… / developer mode") (documentation table row; documentation of a security skill)
```
| `AI_P…003` | Capability Escalation | "enable developer mode", "unlock hidden capabilities", "activate god mode" |
```
tablesecurity skill
low Dangerous commands cmd-cron-mention SKILL.md:341

Mentions editing / listing crontab (documentation table row; documentation of a security skill)
```
| `PERSIST_001` | Crontab modification | `crontab -e`, `crontab -l`, writing to `/var/spool/cron/` |
```
tablesecurity skill
low Dangerous commands cmd-background-process SKILL.md:344

Starts a background / autostarted process (documentation table row; documentation of a security skill)
```
| `PERSIST_004` | Systemd services | `systemctl enable`, writing to `/etc/systemd/`, `.service` files |
```
tablesecurity skill
low Dangerous commands cmd-persistence SKILL.md:345

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)
```
| `PERSIST_005` | macOS LaunchAgents | Writing to `~/Library/LaunchAgents/`, `/Library/LaunchDaemons/` |
```
tablesecurity skill
low Dangerous commands cmd-pipe-to-shell SKILL.md:472

Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation table row; documentation of a security skill)
```
| **Critical** | Exploitable now, immediate damage. | `curl URL \| bash`, `rm -rf /`, env var exfiltration, `eval` on raw input |
```
tablesecurity skill
low Risky intent intent-offensive-security SKILL.md:494

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| `PRIV_ESC` | Privilege escalation |
```
low Dangerous commands cmd-pipe-to-shell TEST-RESULTS-V1.md:35

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
**Erwartet:** Persistence UND curl|bash beide als real findings erkannt, result >= caution. Kein PERSIST pattern_id erwartet für v1.
```
fixturesecurity skill
low Dangerous commands cmd-pipe-to-shell TEST-RESULTS-V1.md:37

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
**Begründung:** v1 findet curl|bash als CRITICAL (explizit in Step 3 🔴) und crontab als "System modification" (Step 3 🟠 HIGH). Beide werden korrekt als by_design:false erkannt. Es gibt keinen PERSIS
```
fixturesecurity skill
low Risky intent intent-offensive-security TEST-RESULTS-V1.md:85

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
1. `pattern_id: CRED…001`, severity: `critical`, title: "Credential harvesting via environment variables", file: `src/config.js`, lines: 4-6, content: `process.env.API_KEY, process.env.DB_PASSWO
```
detectorfixture
low Dangerous commands cmd-pipe-to-shell TEST-RESULTS-V2.md:53

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
**Erwartet:** Persistence UND curl|bash beide als real findings erkannt, result >= caution
```
fixturesecurity skill
low Dangerous commands cmd-pipe-to-shell TEST-RESULTS-V2.md:55

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
**Begründung:** Persistence (PERSIST_001) explizit erkannt, curl|bash als CRITICAL erkannt, result=unsafe.
```
fixturesecurity skill
low Dangerous commands cmd-pipe-to-shell TEST-RESULTS-V2.md:292

Downloads and executes remote code from an unrecognised host (pipe to shell) (test fixture / example file; documentation of a security skill)
```
| 2 | Persistence/Crontab | ✅ PASS | PERSIST + curl\|bash erkannt, result=unsafe |
```
fixturesecurity skill

A further 38 matches are quotations in this security skill's documentation and are not counted as findings.

Files scanned: 36. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning description-no-when description does not say WHEN to use the skill (no "use when")
warning body-long SKILL.md body ≈ 7620 tokens (recommended < 5000); move details to references/

Process rating: all ten parameters 58/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
50When it triggers. No condition that starts the skill
60Tools and files. Uses tools (bash, web, git, python, node) that frontmatter does not declare
70Execution cost. Instruction body is 7620 tokens
85Steps. 47 steps, 1 vague phrases
100Failures and branches. 2 branches, has a failure section
100Consistency. Name and required fields are in place
100Running it twice. Mutating operations check current state
100Progress reporting. Reports progress

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 11 top-level sections: this looks like several domains in one skill
low The response is described with custom markup (11 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
-239 emoji in the instructions: noise for the model
+1No license
+2Single-language instructions
+3Description length 161: enough signal without eating the budget
+4Structure: 41 headings
+3Step-by-step instructions: 47 items
+4Has examples (18 code blocks)
+3All 3 scripts are documented

Quality base 70; lint remarks subtract, signals add up to 100. Result: 63.

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 36

ADVERSARIAL-TEST.md 9K
API-RESPONSES.md 12K
AUDIT-QUALITY-TEST.md 22K
BY-DESIGN-RESEARCH.md 14K
DOCS-REVIEW.md 8K
EVAL-REPORT.md 9K
EXPERT-PANEL-RECOMMENDATION.md 13K
FERRET-ADOPTION-PLAN.md 16K
FERRET-SCAN-ANALYSIS.md 17K
FIX-REPORT.md 3K
INTEGRATION-TEST.md 8K
MASTER-FIX-SPEC-SCRIPTS.md 15K
MASTER-FIX-SPEC-SKILLMD.md 13K
PHASE3-ADVERSARIAL.md 4K
PHASE3-DOCS.md 5K
PHASE3-INTEGRATION.md 6K
PROMPT-ENGINEERING-REPORT.md 4K
PROMPT-FIX-RESULTS.md 2K
PROMPT-TEST-LLAMA.md 4K
PROMPT-TEST-SUITE.md 20K
README-v1-backup.md 3K
README.md 6K
RETEST-REPORT.md 5K
SCRIPT-FIX-RESULTS.md 2K
SKEPTIC-REVIEW.md 8K
SKILL-v1-backup.md 23K
SKILL.md 31K
TEST-REPORT.md 13K
TEST-RESULTS-V1.md 18K
TEST-RESULTS-V2.md 16K
prompts/audit-prompt-v1-backup.md 11K
prompts/audit-prompt.md 17K
prompts/review-prompt.md 3K
scripts/register.sh 2K
scripts/upload.sh 3K
scripts/verify.sh 3K

Frontmatter

metadata: {"openclaw":{"requires":{"bins":["bash","jq","curl"]}}}

Dates

In catalog since —

Updated in catalog 16 Jun 2026

First seen here 7 Sept 2026

Last analysis 11 Sept 2026, 17:07 UTC

Last seen in crawl 22 h ago

Score history

Date		Score	Safety	Qual.
7 Sept 2026	F	25	0	63

Similar skills

F ecap-security-auditor ClawHub