Security audit

arch-optimization

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it overstates production-ready communication while persisting messages to weakly scoped filesystem paths and reporting simulated transports/protocols as successful.

Review carefully before installing in any real agent workflow. Use it only in a disposable or test environment unless recipient identifiers are validated, writable paths are sandboxed, MessagePack is disabled or replaced with a real implementation, and HTTP/WebSocket simulation is made fail-closed or clearly test-only.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: core/transport-layer.js:357
Finding: Recipient-Controlled Path Traversal Allows File Placement Outside the Configured Inbox
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: core/transport-layer.js:676
Finding: HTTP and WebSocket Transports Report Successful Delivery Without Sending Data
Content: View full analysis
setTimeout(resolve, 10)); // Simulate network latency this.stats.messagesSent++; this.stats.lastActivity = Date.now(); return { success: true, transport: 'websocket', simulated: true, latency: Date.now() - startTime, timestamp: Date.now(), message: `WebSocket message would be sent to ${options.to || 'unknown'}` }; } ``` HTTP transport: ```javascript async send(message, options = {}) { if (!this.config.enabled) { throw new Error('HTTP transport is disabled'); } const startTime = Date.now(); // Simplified implementation: record but do not actually send // A production environment should implement a complete HTTP client await new Promise(resolve => setTimeout(resolve, 15)); // Simulate network latency this.stats.requests++; this.stats.successfulRequests++; this.stats.lastRequest = Date.now(); return { success: true, transport: 'http', simulated: true, latency: Date.now() - startTime, timestamp: Date.now(), message: `HTTP request would be sent to ${this.config.baseURL}` }; } ``` ### Technical Analysis Both network transports expose a normal `send()` interface and return `success: true`, but neither implementation performs network I/O. They only delay execution and update success statistics. The surrounding u ...[truncated 1728 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: core/protocol-layer.js:259
Finding: Simulated MessagePack Serialization Discards Original Messages and Fabricates Deserialized Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: pack-delivery.sh:17
Finding: Predictable Shared Temporary Directory Allows Local Package-Build Manipulation
Content: View full analysis
/dev/null mv "$ZIP_FILE" "$SCRIPT_DIR/" # Clean up temporary directory cd "$SCRIPT_DIR" rm -rf "$TEMP_DIR" ``` ### Technical Analysis The script creates a temporary path using a timestamp with one-second granularity. This path is predictable and is created with `mkdir -p`, which does not require that the directory be newly and exclusively created by the current process. An attacker with local access can predict the directory name and pre-create it with permissive permissions and attacker-controlled contents. The script does not verify directory ownership, permissions, emptiness, or whether path components are symbolic links before copying files and building the archive. Because the archive command includes every entry matched by `./*`, pre-existing attacker files can be included in the resulting delivery package. Depending on permissions and filesystem state, pre-created links or directories can also redirect copy operations or cause denial of service. ### Attack Path 1. A local attacker predicts when the packaging script will run. 2. The attacker pre-creates `/tmp/arch-optimization-YYYYMMDD-HHMMSS` with writable permissions. 3. The attacker places an additional malicious file or manipulated directory structure in it. 4. The victim executes `pack-delivery.sh` during the predicted second. 5. `mkdir -p` acc ...[truncated 1086 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (64)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A skill advertised as a communication framework but actually focused on benchmarking and filesystem test artifact handling creates a trust gap between claimed and real behavior. Users may run it in sensitive environments expecting message handling while it performs local file creation, deletion, and result export, which can have unintended operational or security consequences.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A skill advertised as a communication framework but actually focused on benchmarking and filesystem test artifact handling creates a trust gap between claimed and real behavior. Users may run it in sensitive environments expecting message handling while it performs local file creation, deletion, and result export, which can have unintended operational or security consequences.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A skill advertised as a communication framework but actually focused on benchmarking and filesystem test artifact handling creates a trust gap between claimed and real behavior. Users may run it in sensitive environments expecting message handling while it performs local file creation, deletion, and result export, which can have unintended operational or security consequences.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A skill advertised as a communication framework but actually focused on benchmarking and filesystem test artifact handling creates a trust gap between claimed and real behavior. Users may run it in sensitive environments expecting message handling while it performs local file creation, deletion, and result export, which can have unintended operational or security consequences.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
const { UnifiedAgentComm } = require('./core/unified-api.js');

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
const { UnifiedAgentComm } = require('./core/unified-api.js');

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
#### 1. **统一传输层 (`transport-layer.js`)**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
md
#### 2. **协议层 (`protocol-layer.js`)**

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
node tests/performance-comparison.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.
md
node tests/performance-comparison.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
node tests/quick-minimal-test.js

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · core/unified-api.js (reported line 154)May include surrounding context.
js
latency: Date.now() - startTime }); throw new Error(`Failed to send message to ${recipient}: ${error.message}`); } }

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The request/response logic appears inverted or mislabeled: code comments say it is handling request-response, but the receive path resolves pending requests when _type === 'request' rather than when a response type is received. This can let an incoming crafted request with a guessed or leaked _requestId satisfy a pending promise, causing response spoofing, state confusion, and incorrect trust in attacker-controlled data.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · core/transport-layer.js (reported line 505)May include surrounding context.
js
// 2. 应用规则引擎 const ruleResult = this.ruleEngine.evaluate(message, options); if (ruleResult.transport) { return ruleResult.transport; } // 3. 机器学习推荐（如果启用）

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · core/transport-layer.js (reported line 516)May include surrounding context.
js
// 2. 应用规则引擎 const ruleResult = this.ruleEngine.evaluate(message, options); if (ruleResult.transport) { return ruleResult.transport; } // 3. 机器学习推荐（如果启用）

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · docs/protocol-layer-design.md (reported line 520)May include surrounding context.
md
// 2. 应用规则引擎 const ruleResult = this.ruleEngine.evaluate(message, options); if (ruleResult.transport) { return ruleResult.transport; } // 3. 机器学习推荐（如果启用）

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · docs/transport-layer-design.md (reported line 387)May include surrounding context.
md
// 2. 应用规则引擎 const ruleResult = this.ruleEngine.evaluate(message, options); if (ruleResult.transport) { return ruleResult.transport; } // 3. 机器学习推荐（如果启用）

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README is entirely in Chinese and does not provide an alternative language option or indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This can violate a language/locale policy when users are not given an opt-in or clear justification for the restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README promotes filesystem, WebSocket, and HTTP transport capabilities plus automatic retry/fallback behavior, but it does not warn users about data exfiltration, unintended file writes, permission scope, or network-side effects. In an agent skill context, encouraging unified transport and automatic routing without explicit safety guidance can lead operators to enable capabilities that affect local systems or external endpoints without understanding the risk boundaries.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documents filesystem, HTTP, and WebSocket communication behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing capability boundaries can let a seemingly routine communication skill access files or network channels without transparent user consent or policy enforcement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description and instructions are presented exclusively in Chinese, with no indication that the user can select another language or that the skill is intentionally limited to a Chinese-language audience. Per the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation encourages agent-to-agent transmission and filesystem-based message passing without warning about confidentiality, integrity, retention, or cross-tenant exposure risks. In practice, writing messages to shared directories or passing them between agents can leak sensitive data, permit tampering, or create unauthorized persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documents HTTP and WebSocket transports without user-facing warnings about sending data across network boundaries. That can cause operators to expose internal agent messages over insecure or unintended channels, especially when example URLs use plain HTTP and WS rather than authenticated, encrypted transports.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's human-readable comments and operational log/test strings are written in Chinese throughout, with no indication that users may choose another language or that the skill is intentionally region-specific. This creates a locale/language policy concern because the skill appears to impose a language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code serializes the provided message and writes it to a JSON file on disk, which can affect user data and system state. Although comments describe the implementation, they are internal and do not disclose to the user that message contents will be persisted under the workspace directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.