Windows文件管理器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This is a file-management skill with expected file access, but its delete and batch-operation examples can permanently remove user files without enforced safeguards.

Review carefully before installing. Only use this skill in a tightly scoped workspace, avoid following its pip install command as written, and require explicit confirmation plus backups before any delete, overwrite, recursive, or batch operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unnecessary Installation of Standard-Library-Named Packages Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install shutil pathlib glob2

Technical Analysis

The skill instructs users or an executing agent to install shutil, pathlib, and glob2 from the Python Package Index. However, shutil and pathlib are already part of Python's standard library and do not require installation. The examples also import the standard-library glob module rather than glob2.

Installing packages whose names overlap with standard-library modules unnecessarily introduces a dependency-confusion and package-impersonation risk. Packages obtained through pip may execute package-controlled build or installation logic and subsequently run code when imported. The project does not pin versions, verify hashes, constrain an index, or otherwise authenticate the packages.

No evidence establishes that the named packages are currently malicious. The vulnerability is the unnecessary and unverified third-party installation instruction, which exposes users to avoidable supply-chain risk.

Attack Path

1. A user or agent follows the documented installation instructions.
2. pip resolves the standard-library-named packages from a configured public or private package index.
3. An attacker-controlled, compromised, or impersonating package is selected because no version or hash is pinned.
4. Package-controlled code executes during installation, building, or a later import.
5. The code runs with the privileges of the user or agent that invoked pip.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing process. Depending on those privileges, this may permit access to user files, environment variables, credentials available to the process, and other local resources. If installation is performed from an ele ...[truncated 64 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the pip install shutil pathlib glob2 instruction.
• Use Python's built-in os, shutil, pathlib, and glob modules without installing external packages.
• Update the metadata to state that only a compatible Python runtime is required.
• If a genuine third-party dependency is introduced later, pin an exact reviewed version and verify package hashes with a lock file or --require-hashes.
• Use a trusted package index and review package ownership, source code, and release history before publication.
• Run dependency installation in a restricted virtual environment without administrator privileges.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:72

Finding

Destructive File Operations Bypass the Documented Safety Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:72-77, SKILL.md:112-115, SKILL.md:232-239, and SKILL.md:295-307
Vulnerability Type: Unvalidated destructive filesystem operations
Risk Level: High

Vulnerable Code

The single-file deletion function immediately removes the supplied path:

python

def delete_file(file_path: str) -> bool:
    """删除文件"""
    if os.path.exists(file_path):
        os.remove(file_path)
        return True
    return False

The directory deletion function recursively removes the supplied directory:

python

def delete_folder(folder_path: str):
    """删除文件夹（递归）"""
    shutil.rmtree(folder_path)
    return True

Batch deletion expands a caller-controlled glob and removes every matching path:

python

def batch_delete(folder: str, pattern: str):
    """批量删除文件"""
    files = glob.glob(f"{folder}/{pattern}")
    deleted = []
    for file_path in files:
        os.remove(file_path)
        deleted.append(file_path)
    return deleted

Safety functions are defined separately but are never called by these destructive functions:

python

def safe_check(file_path: str) -> bool:
    """检查操作是否安全"""
    abs_path = os.path.abspath(file_path)
    for dangerous in DANGEROUS_PATHS:
        if dangerous.lower() in abs_path.lower():
            print(f"⚠️ 警告: 路径包含系统目录: {dangerous}")
            return False
    return True

def confirm_dangerous(operation: str, file_path: str):
    """要求确认危险操作"""
    return input(f"⚠️ 确认执行 {operation} {file_path}? (y/n): ").lower() == 'y'

Technical Analysis

delete_file, delete_folder, and batch_delete accept paths or patterns and perform irreversible deletion without invoking safe_check or confirm_dangerous. The advertised safety functions therefore do not enforce any security boundary.

shutil.rmtree recursively deletes a complete directory tree. Meanwhile, `batc ...[truncated 2096 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce safety checks inside every destructive function rather than relying on callers to invoke them.
• Require callers to select an explicit approved root directory and reject targets outside that root.
• Resolve paths with Path.resolve() and verify containment using path-aware comparisons such as Path.is_relative_to(), not substring matching.
• Reject empty paths, filesystem roots, drive roots, home directories, system directories, traversal outside the approved root, and patterns that are unexpectedly broad.
• Detect and safely handle symbolic links, Windows junctions, mount points, and other filesystem redirection mechanisms.
• Present the canonical target and the complete set or count of affected files before execution.
• Require explicit confirmation for recursive and batch deletion. For noninteractive execution, require a separate, deliberate authorization flag.
• Implement a dry-run mode and make it the default for batch operations.
• Prefer moving files to a recoverable quarantine or recycle-bin location instead of immediately deleting them.
• Apply maximum file-count and total-size limits to batch operations, with separate confirmation when limits are exceeded.
• Record success and failure for each target in an audit log without exposing sensitive file contents.
• Add tests proving that protected paths, traversal attempts, symlink or junction escapes, root paths, and overbroad wildcards are rejected.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill prominently advertises delete capabilities for files and folders, including recursive folder deletion, without pairing them with strong warnings, default confirmations, or rollback guidance. In a file-management skill, this context makes the issue more dangerous because the primary purpose is to act on user files and mistakes can immediately cause irreversible data loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill metadata and documentation are written to operate in Chinese, including the activation phrase and output template, but there is no statement that the language is user-selectable or that the skill is intentionally restricted to Chinese-speaking users. This can violate language or locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims its safety mechanisms are complete, but the documented examples invoke destructive operations like delete, move, and batch actions without enforcing any safety check or confirmation step. This can mislead users and downstream agents into trusting unsafe behavior, increasing the chance of accidental data loss or unsafe automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation phrases are broad enough to match ordinary discussion of file handling, which can cause the skill to trigger in contexts where the user did not intend real filesystem actions. In a skill capable of deletion, moving, and batch operations, overbroad invocation materially raises the risk of accidental destructive execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The so-called safety layer is weak because it relies on a blacklist of substrings and is never integrated into the file-operation functions themselves. Blacklists are easy to bypass with alternate paths, symlinks, junctions, casing, or unlisted sensitive directories, so destructive operations can still affect critical locations without protection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.