Desktop Cleanup Playbook

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:46 AM UTC
• Version: 1.0.0

Overview

This skill is a local, mostly read-only desktop cleanup planner, with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you want a Chinese-language desktop cleanup planning aid. Point it at a specific desktop folder or file list, avoid broad home or system directories, and review generated plans before using them to move or delete files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a desktop cleanup planning aid, but the detected behavior set extends into generic directory auditing, content scanning for secrets or private URLs, CSV/TSV inspection, and Skill-project validation. This broader behavior can cause over-collection and inspection of sensitive file contents unrelated to desktop organization, making the skill more dangerous because users may consent to benign cleanup analysis without realizing it may examine arbitrary content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script includes a generic pattern-based security scanner that looks for secrets, private URLs, and dangerous shell constructs in arbitrary files, which is outside the declared desktop cleanup planning scope. In this context, that expands the skill into a broader local auditing tool and can expose sensitive file contents or repository data unnecessarily during normal use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can inspect arbitrary local files and directories for secret-like values and risky shell patterns, then includes matched snippets in its output. Even though one pattern partially masks secrets, this behavior still turns the skill into a local security scanner and risks disclosing sensitive content unrelated to desktop cleanup.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation examples "给我桌面整理方案" and especially "先分析不要直接动文件" are natural everyday phrases rather than narrowly scoped activation triggers. The README does not define explicit trigger constraints or negative examples, so the skill could be invoked in situations where the user is speaking generally rather than intending this specific skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill references executable shell usage via `python3 "{baseDir}/scripts/run.py"` and implies file input/output behavior, but it declares no explicit tool scope such as allowed tools or permissions. That mismatch can let an agent invoke stronger capabilities than reviewers or policy expect, increasing the chance of unintended filesystem access or execution in a skill that should primarily produce a review-only cleanup plan.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The entire example output is written in Chinese and presents the skill output format as fixed, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The title, category label, summary, input hint, sections, use cases, examples, and risk text are all written in Chinese, with no indication that the skill is optional for Chinese-speaking users only or that another language can be selected. This creates a natural-language locale constraint without user opt-in, which matches the language policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template title and instructions are written only in Chinese, and the file presents the output structure as a fixed template rather than offering a language or locale choice. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Multiple user-facing report strings are emitted in Chinese, such as headings and action prompts, and there is no option to select another language. For a general-purpose support script, this creates a language/locale policy issue because it forces a specific language without user opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The directory scanning logic recursively enumerates text files under any user-supplied root and inspects filenames, extensions, and markdown headings. For a desktop cleanup planner, this is overly broad because it can survey arbitrary directories and reveal content structure outside the intended desktop-only workflow.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill repository audit checks for package structure, frontmatter, and metadata validity, which is unrelated to organizing desktop files. This broadens the tool's operational scope and enables inspection of arbitrary skill or repository layouts without a clear user need tied to the declared purpose.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire smoke-test document is written in Chinese and does not indicate that language selection is optional or that the skill is region-specific. This can violate language/locale policy when users or operators are not given a choice of language.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown file presents all user-facing content in a single language and does not indicate that the language was selected by the user or that the skill is region-specific. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The markdown content is entirely in Chinese and includes output-formatting instructions, but it does not offer the user a language choice or explain that the skill is intended only for a Chinese-language context. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.

Static analysis

No suspicious patterns detected.