Security audit

Template Snippet Switchboard

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly formats template and snippet material, but its bundled script contains under-disclosed local audit and pattern-scanning code that can inspect files.

Review before installing. The ordinary template-formatting path looks local and non-networked, but the package includes broader audit/scanning code than the template description suggests. Use it only on non-sensitive inputs or in a constrained workspace unless the publisher removes or clearly documents those extra modes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description focuses on managing reusable templates/snippets and writing workflow variants, including scenario/role/tone/length switching and version maintenance. The code does not implement template library management, snippet switching, role/tone/length selection, or version control features. Instead, it is a command-line auditing/reporting utility driven by a spec.json mode: it scans directories, summarizes CSVs, detects risky regex patterns such as curl|bash and secrets, and validates Skill directory structure and frontmatter. While it outputs markdown reports and uses a template/spec resource, that is only for formatting audit results, not for managing writing templates. This is a materially different primary purpose with several undeclared analysis/audit capabilities, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script implements directory auditing, file enumeration, Markdown heading extraction, CSV inspection, and risky-pattern scanning that materially exceed the declared scope of a template/snippet switchboard. This broadens the skill into a general local inspection tool, which can expose unrelated workspace contents and sensitive data when run on arbitrary paths.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The pattern scanner reads arbitrary files and searches for secrets, private URLs, and dangerous shell constructs, then emits matched snippets into the report. In a template-management skill, this is context-inappropriate and risky because it can surface sensitive tokens or internal paths from unrelated files, even with partial masking.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill_audit functionality validates arbitrary Skill package structures and parses SKILL.md metadata, which is unrelated to managing reusable writing templates. In this context, it creates an unnecessary capability to inspect other local projects and package contents, increasing the chance of unintended data exposure and scope creep.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger examples are broad natural-language phrases such as '帮我整理一套模板片段库' and '按角色和语气切换', which are plausible in many ordinary writing or documentation contexts. In systems that auto-route based on fuzzy matching, this can cause unintended activation of the skill, leading to incorrect handling of user input, accidental disclosure of local template content, or bypass of a more appropriate workflow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable capability via python3 and references local resources that imply file access, but it does not declare any explicit tool scope or permission boundary. In an agent ecosystem, undeclared shell/file capabilities reduce auditability and can allow the skill to be invoked with more power than reviewers or users expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims to be 'default read-only' and to prefer review/dry-run behavior, yet it explicitly instructs the agent to execute a Python script when shell/exec is available. That contradiction can mislead operators into trusting the skill as low risk while it retains code-execution capability, increasing the chance of unintended file modification or execution of unsafe logic.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: A template/snippet management skill does not inherently require shell-based execution, so adding python3 .../scripts/run.py expands the attack surface without strong justification in the stated purpose. If an attacker can influence inputs, script behavior, or surrounding files, this could become a vehicle for unauthorized file access, content generation from arbitrary local data, or command-adjacent abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all headings and instructions exclusively in Chinese, and it does not indicate that the user can choose a language or that Chinese is required for a documented, region-specific reason. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title, category label, summary, and input hint are all written in Chinese, which indicates a fixed language choice in the skill's natural-language interface. The file does not offer language selection or explain that this is intentionally limited to a Chinese-speaking or region-specific context, creating a locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file title and all template content are written exclusively in Chinese, indicating the skill output template is constrained to a specific language. There is no natural-language indication that users may choose another language or that the locale restriction is optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report-generating functions emit fixed Chinese-language headings and guidance such as '结果', '摘要', and '下一步'. This enforces a specific language/locale in user-facing output without offering opt-in, selection, or justification, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The directory report presents headings and review instructions entirely in Chinese, including '扫描报告', '目录概览', and other fixed labels. Because the script is a general-purpose local support tool, forcing one language without user opt-in is a policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CSV report uses fixed Chinese phrases like '数据报告' and '字段概览', and similar hard-coded Chinese text appears in other audit outputs. This creates a language policy violation because the tool does not offer a language choice or explain a regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file content is entirely written in Chinese and includes output-shaping requirements without offering any language or locale choice. Under the natural-language policy check, this can be interpreted as forcing a specific language by default rather than providing user opt-in or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language is provided. The file does not indicate that the skill is intentionally region-specific or that users may choose another language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.