Security audit

Desktop Cleanup Playbook

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, mostly read-only desktop cleanup planner, with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you want a Chinese-language desktop cleanup planning aid. Point it at a specific desktop folder or file list, avoid broad home or system directories, and review generated plans before using them to move or delete files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a desktop cleanup planning aid, but the detected behavior set extends into generic directory auditing, content scanning for secrets or private URLs, CSV/TSV inspection, and Skill-project validation. This broader behavior can cause over-collection and inspection of sensitive file contents unrelated to desktop organization, making the skill more dangerous because users may consent to benign cleanup analysis without realizing it may examine arbitrary content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script includes a generic pattern-based security scanner that looks for secrets, private URLs, and dangerous shell constructs in arbitrary files, which is outside the declared desktop cleanup planning scope. In this context, that expands the skill into a broader local auditing tool and can expose sensitive file contents or repository data unnecessarily during normal use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code can inspect arbitrary local files and directories for secret-like values and risky shell patterns, then includes matched snippets in its output. Even though one pattern partially masks secrets, this behavior still turns the skill into a local security scanner and risks disclosing sensitive content unrelated to desktop cleanup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation examples "给我桌面整理方案" and especially "先分析不要直接动文件" are natural everyday phrases rather than narrowly scoped activation triggers. The README does not define explicit trigger constraints or negative examples, so the skill could be invoked in situations where the user is speaking generally rather than intending this specific skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill references executable shell usage via python3 "{baseDir}/scripts/run.py" and implies file input/output behavior, but it declares no explicit tool scope such as allowed tools or permissions. That mismatch can let an agent invoke stronger capabilities than reviewers or policy expect, increasing the chance of unintended filesystem access or execution in a skill that should primarily produce a review-only cleanup plan.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire example output is written in Chinese and presents the skill output format as fixed, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title, category label, summary, input hint, sections, use cases, examples, and risk text are all written in Chinese, with no indication that the skill is optional for Chinese-speaking users only or that another language can be selected. This creates a natural-language locale constraint without user opt-in, which matches the language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template title and instructions are written only in Chinese, and the file presents the output structure as a fixed template rather than offering a language or locale choice. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Multiple user-facing report strings are emitted in Chinese, such as headings and action prompts, and there is no option to select another language. For a general-purpose support script, this creates a language/locale policy issue because it forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The directory scanning logic recursively enumerates text files under any user-supplied root and inspects filenames, extensions, and markdown headings. For a desktop cleanup planner, this is overly broad because it can survey arbitrary directories and reveal content structure outside the intended desktop-only workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill repository audit checks for package structure, frontmatter, and metadata validity, which is unrelated to organizing desktop files. This broadens the tool's operational scope and enables inspection of arbitrary skill or repository layouts without a clear user need tied to the declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire smoke-test document is written in Chinese and does not indicate that language selection is optional or that the skill is region-specific. This can violate language/locale policy when users or operators are not given a choice of language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all user-facing content in a single language and does not indicate that the language was selected by the user or that the skill is region-specific. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown content is entirely in Chinese and includes output-formatting instructions, but it does not offer the user a language choice or explain that the skill is intended only for a Chinese-language context. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.
Content: No source excerpt is available for this finding.