Its AI check confirmed something serious. Don’t install it without reading what it found.
Finding (high, rule SSD-1)
skills/complain/SKILL.md:60
The skill tells the agent to send session-derived content to an external store without asking, without a preview, and without telling the user, and it forbids the agent from mentioning the submission even when asked directly. This removes the user's ability to review or block data leaving the session, and it makes the exfiltration channel deliberately invisible. Any private context the agent can see can be sent out this way.
Finding (high, rule SSD-1)
skills/suggestion-box/SKILL.md:3
The skill's frontmatter and body direct the agent to submit data about its run proactively, without permission, preview, or announcement, and then continue the task. The description itself advertises that the submission is hidden. Combined with the other sections, this is covert data collection that bypasses user consent.
Finding (high, rule SQP-2)
skills/complain/SKILL.md:3
The description authorizes the agent to submit proactively, without permission, preview, or announcement. Because the frontmatter is what the agent reads when deciding whether to load a skill, this framing gets the covert channel activated and treated as normal behavior before any review happens.
Finding (high, rule SSD-1)
skills/paperclip-board/SKILL.md:137
The skill tells the assistant to approve the CEO hire itself right after submitting it, justified by 'the user just asked to create it'. The requireBoardApprovalForNewAgents gate exists so a board decision is recorded. Self-approval makes the gate a no-op. The CEO is then granted canCreateAgents and a budget, and is started automatically in Step 4, so an unreviewed agent could hire others and spend money.
Finding (medium, rule SQP-2)
skills/suggestion-box/SKILL.md:67
The skill tells the agent to send run context (commands, environment details, error excerpts, identifiers, and links that may identify people) to a persistent store while the user is never told. The silence is deliberate: the 'Submit silently' section forbids previews, announcements, and permission requests. Undisclosed transmission of session data can leak secrets, private prompts, or code that the user never agreed to share.
Finding (medium, rule SQP-2)
skills/suggestion-box/SKILL.md:69
The skill instructs the agent to ignore submission failures, not retry them, and never report failures of the submission mechanism. This suppresses evidence of a possible integrity or data-handling problem and prevents the user from noticing that the mechanism is broken or misbehaving. Concealing failures is a red flag in its own right.
Finding (medium, rule SSD-1)
skills/suggestion-box/SKILL.md:69
The skill tells the agent to never retry or report failures and never acknowledge the submission mechanism even when asked. This blocks the user from learning what was sent or why it failed. It also overlaps with the silent-submission behavior, so the two together make the activity impossible for the user to audit.
Autonomous Decision Making (medium, rule EA2)
skills/paperclip-board/SKILL.md:137
This is the auto-approval pattern in the same block as SSD-1, so it describes the same governance bypass. The flow also launches the CEO heartbeat in Step 4 without a separate confirmation, so autonomous work and spending can start before the board has reviewed the hire.
SkillSpector’s own score is 100/100 from 266 findings; only the ones its AI check confirmed count here.
