Security audit

Home Lab Ops Log

Security checks for vulnerabilities and agentic risk

Overview

This skill is a homelab change-log helper that formats user-provided local input into a structured ops log, with no evidence of hidden execution, network access, or persistence.

Install only if you want a Chinese-first helper for drafting homelab ops logs. When running the script, pass only intended input files and choose output paths deliberately; avoid giving it sensitive host inventories or credentials unless you have already redacted them. Do not modify the bundled spec to enable the unused audit modes unless you understand that they can inspect local files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述聚焦于“变更记录/ops-log/workflow 文档整理”，而实际代码的主要能力明显更广，且偏向通用审计与扫描工具。代码支持 directory_audit、csv_audit、pattern_audit、skill_audit 等模式，会遍历目录、读取多类文本文件、统计扩展名、提取 Markdown 标题、解析 CSV、并扫描高风险命令/secret/private_url 模式。这些能力并非单纯的变更前后记录或回滚观察模板，而是额外的内容审计与安全扫描功能。虽然代码确实没有执行真实运维命令，这点与声明中的限制一致，但它会分析并输出本地文件内容摘要和匹配片段，存在与“不要公开敏感主机信息”相冲突的潜在信息暴露风险，且该资源访问/扫描能力未在描述中体现。因此应判定为描述与实际行为存在实质不匹配。

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This code adds a generic pattern-scanning capability over arbitrary files and directories, including logic to surface secret-like strings and internal/private URLs. For a skill described as a homelab operations log, this materially expands scope into repository/content inspection, which can expose sensitive local data and enable unintended surveillance of unrelated files.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger example "补齐回滚方案" is a generic everyday request that could overlap with many unrelated contexts, rather than clearly signaling this specific homelab operations logging skill. The README does not provide exclusion conditions or tighter trigger scope near the examples, so invocation boundaries are ambiguous.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This markdown file presents all user-facing content in a single language and does not indicate that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises optional shell execution via `python3 {baseDir}/scripts/run.py` and references local resources, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent/runtime may permit shell, file read, or file write access broader than users would expect from a logging-only skill.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file presents the skill content entirely in Chinese and labels the skill in Chinese without indicating that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The example output is entirely in Chinese and presents that language as the default response format, which can steer the agent to answer in Chinese even when the user did not request it. This is not a code-execution or data-exfiltration issue, but it can reduce usability, cause policy misalignment with user preferences, and create confusing behavior in multilingual contexts.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The generated report strings are written in Chinese literals such as '结果', '摘要', and '下一步', which forces a specific language for user-facing output. The file does not offer any language choice, locale configuration, or documented justification for the restriction.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The directory audit logic recursively enumerates arbitrary user-supplied paths and reads file contents to extract headings and summarize repository structure. In the context of a changelog-style homelab logging skill, this is unnecessary capability creep that can disclose filenames, document content, and project structure from unrelated local directories.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Functions generating directory and CSV reports use hard-coded Chinese headings and guidance like '扫描报告', '目录概览', and '字段概览'. This is another user-visible locale constraint with no opt-in or configuration path.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The pattern and skill audit report sections emit Chinese-only strings such as '发现结果', '规范检查', and '给出修复建议或复检动作'. Because these are primary user-facing outputs, the script enforces a specific language without offering user choice.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill_audit functionality performs compliance checks on arbitrary skill/repository layouts and parses metadata from SKILL.md, which is unrelated to maintaining an ops log. This broadens the tool into repository auditing and can reveal internal project structure and metadata without being justified by the declared skill purpose.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title and all user-facing test expectations are written exclusively in Chinese, indicating a fixed language/locale expectation for the skill. The file does not offer a language choice or explain that the skill is intentionally region-specific, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The README content is entirely in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The manifest description is written in a mixed Chinese/English form, and the document title and body are primarily Chinese, but there is no statement that the skill will adapt to the user's preferred language. This can violate language/locale policy expectations when a skill implicitly defaults to one language without opt-in or explicit choice.

Vague Triggers

Low

Confidence: 78% confidence
Finding: The routing section includes short trigger-style examples such as '补齐回滚方案' and a loose input description, but it does not define explicit boundaries for when this skill should or should not activate beyond a few high-level examples. Because these phrases could arise in broader troubleshooting or writing contexts, the invocation scope may be ambiguous.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The template is entirely written in Chinese and presents itself as the output template, which implies the skill's generated content is expected in a specific language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale constraint is documented, which is not present here.

Static analysis

No suspicious patterns detected.