Genecyber Loadout Prompts

Security Audit Guide Template

This guide provides a structured approach for analyzing skill security and identifying potential vulnerabilities.

Overview

When auditing a skill, you are performing a comprehensive security review to ensure it is safe to use. This includes analyzing scripts, verifying frontmatter claims, assessing trust levels, and flagging suspicious patterns.

Skill Information to Gather

Before beginning the audit, collect the following information:

• Name: The skill's identifier
• Description: What the skill claims to do
• Path: Location of the skill directory
• SKILL.md Path: Location of the main skill file
• Author: Who created the skill (if specified)
• Version: Current version (if specified)
• License: License type (if specified)

Audit Checklist

1. Script Analysis

For each script in the scripts/ directory, perform the following checks:

• Shell Injection Vulnerabilities

  • Look for unescaped variables in shell commands
  • Check for eval usage with user input
  • Identify $() or backtick command substitution with untrusted data
  • Search for source or . commands with dynamic paths

• Network Calls

  • Identify curl, wget, fetch, or HTTP request patterns
  • Check for outbound connections to unknown hosts
  • Verify any API endpoints are legitimate
  • Look for data exfiltration patterns

• File System Operations

  • Catalog all read operations
  • Identify write operations and their targets
  • Check for delete or modify operations
  • Verify operations stay within appropriate boundaries

• External Command Execution

  • List all external commands invoked
  • Check for dynamic command construction
  • Verify necessity of each command

• Input Validation

  • Check if inputs are validated before use
  • Verify sanitization of special characters
  • Look for proper quoting of variables

2. Frontmatter Verification

Compare declared metadata with actual capabilities:

• Name Verification

  • Does the name accurately reflect the skill's purpose?
  • Is it misleading in any way?

• Description Accuracy

  • Does the description match what the code actually does?
  • Are there undisclosed capabilities?

• Author/License Validation

  • Can the author be verified?
  • Is the license appropriate for the code's behavior?

• Capability Matching

  • Do declared capabilities match actual code behavior?
  • Are there hidden features not mentioned?

3. Code Block Analysis

For each code block in the SKILL.md:

• Language Identification

  • What language is the code block written in?
  • Is the language appropriate for the stated purpose?

• Purpose Assessment

  • What does this code block demonstrate?
  • Is it an example, instruction, or executable code?

• Dangerous Pattern Detection

  • Check for malicious patterns disguised as examples
  • Verify examples don't contain harmful code
  • Look for social engineering attempts

4. Trust Assessment

Evaluate the trustworthiness of the skill source:

• Author Reputation

  • Is this from a known/trusted author?
  • Can you verify the author's identity?
  • Does the author have a track record?

• Code Transparency

  • Is the code well-documented?
  • Are intentions clear and understandable?
  • Is there adequate commenting?

• Obfuscation Detection

  • Are there any obfuscated sections?
  • Is any code unnecessarily complex?
  • Are there unexplained binary or encoded sections?

• Permission Scope

  • Does the skill request excessive permissions?
  • Are requested permissions justified by functionality?

5. Suspicious Patterns to Flag

Watch for these red flags:

Audit Instructions

Step 1: Read the SKILL.md File

Load and review the complete SKILL.md content to understand the skill's stated purpose and instructions.

Step 2: Enumerate All Scripts

List all files in the scripts/ directory and read each one completely.

Step 3: Systematic Analysis

Work through the checklist above, documenting findings for each item.

Step 4: Cross-Reference

Compare what the skill claims to do (frontmatter, documentation) with what it actually does (scripts, code).

Step 5: Generate Security Assessment

Provide a comprehensive report including:

Risk Level Classification

Report Template

## Security Assessment: [Skill Name]

### Risk Level: [LOW/MEDIUM/HIGH/CRITICAL]

### Summary
[Brief overview of findings]

### Findings

#### Critical Issues
- [List critical issues with file:line references]

#### Warnings
- [List warnings with file:line references]

#### Notes
- [List informational notes]

### Recommendations
1. [Specific remediation steps]
2. [Additional recommendations]

### Conclusion
[Safe to use / Use with caution / Do not use]

Example Audit Workflow

1. Initial Scan

   - Read SKILL.md frontmatter
   - List scripts/ directory
   - List references/ directory
   

2. Deep Analysis

   - Read each script file
   - Identify all external calls
   - Map data flow
   

3. Risk Assessment

   - Categorize findings by severity
   - Determine overall risk level
   - Generate recommendations
   

4. Final Report

   - Compile all findings
   - Provide actionable recommendations
   - State clear conclusion
   

Additional Resources

• OWASP Command Injection Prevention
• CWE-78: OS Command Injection
• Shell Script Security Best Practices