Security audit

Clipboard Knowledge Capture

Security checks for vulnerabilities and agentic risk

Overview

This skill runs locally and does not show exfiltration or destructive behavior, but its bundled script contains broad local audit and scanning modes that are not clearly aligned with the advertised clipboard-capture purpose.

Review before installing if you expected only a narrow clipboard formatter. Use it only with deliberate, non-sensitive local inputs, avoid pointing it at broad private directories, and be aware that the bundled script contains inactive audit/scanning code beyond the headline workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 描述强调的是“剪贴板片段沉淀到本地知识库”的捕获型工作流，但代码实际是一个通用本地分析/审计报告生成器。它通过 spec['mode'] 在 structured_brief、directory_audit、csv_audit、pattern_audit、skill_audit 之间切换，核心行为是读取路径、遍历目录、抽样文本文件、解析 CSV、正则扫描高风险模式，以及检查 Skill 项目结构。代码没有任何剪贴板接口、知识库持久化逻辑、来源补全机制、标签生成机制或后续行动管理逻辑。相反，它具备明显的文件系统审计和安全模式扫描能力，这属于未声明且与主要用途 materially different 的能力。因此描述与实际行为存在明显不匹配。

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises clipboard-to-local-knowledge capture, but the main dispatch logic supports broad directory, CSV, pattern, and skill auditing modes. This creates a significant capability mismatch: a user invoking a seemingly narrow clipboard workflow could instead cause enumeration and analysis of arbitrary local files and repositories, increasing unintended data access and exfiltration risk through generated reports.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases are short and generic enough that they may match ordinary clipboard or note-taking requests outside the user's intent to invoke this specific skill. That can cause accidental routing of unrelated content into a knowledge-capture workflow, increasing the chance of processing sensitive clipboard material or producing misleading outputs without explicit confirmation.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable behavior via `python3 .../scripts/run.py` and references local resource reads/writes, but it does not declare any explicit tool scope such as allowed shell or filesystem permissions. This creates an authority ambiguity problem: a caller or runtime may grant broader access than users expect, increasing the risk of unintended local file access or command execution under a benign-looking clipboard workflow.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code recursively inventories directories, samples multiple text file types, and extracts headings and content from local files. For a clipboard capture skill, this is excessive filesystem access and can unintentionally collect unrelated private data into reports, especially when pointed at broad paths.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code generates user-facing report content entirely in Chinese, including headings, prompts, and next-step instructions. Because the file provides no opt-in, configuration, or justification for enforcing a specific language, it violates the language/locale policy criteria.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The regex-based pattern scanner searches files for secrets, private URLs, and dangerous shell commands, which is not justified by a clipboard knowledge-capture skill. Even though it does not execute matches, it still reads and reports sensitive local content, creating unnecessary exposure of credentials and internal references in output artifacts.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill_audit path inspects a target directory for repository structure, metadata, and validation artifacts unrelated to the declared clipboard-capture purpose. In this context, that hidden audit functionality broadens local file inspection and could expose sensitive project layout or contents when a user expects only note capture behavior.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The file is entirely written in Chinese and includes a direct instruction at L16 to '使用清晰标题', implying the skill output is expected in Chinese. Under the language/locale policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This markdown example output forces a specific language/locale presentation throughout the file. Under the policy rule, language constraints should either offer user choice or be clearly documented as justified; neither is present here.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This manifest presents the title, labels, examples, and risk text only in Chinese, which can amount to a language/locale constraint in the skill's natural-language interface. The file does not indicate that the language is optional, selectable, or justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: The entire template, including the title and all section prompts, is written only in Chinese, which implies the skill expects or enforces Chinese output. Under the policy criteria, a language constraint should either offer user choice or be clearly documented as a justified locale-specific requirement.

Static analysis

No suspicious patterns detected.