Security audit

文本对比工具

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward text and file comparison skill with no evident hidden, network, credential, persistence, or destructive behavior.

Installers should be aware that generic words like diff or compare may invoke the skill unexpectedly. Use it for text or files you intend to compare, since diff output can reveal the contents of those inputs in the chat.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation phrases are broad enough to match common conversational terms such as '对比', 'diff', and '找不同', which can cause unintended skill invocation during normal user interactions. In an agent setting, accidental activation can route unrelated content into file/text comparison workflows, increasing the chance of data exposure or confusing behavior even though the skill itself is not overtly dangerous.

Static analysis

No suspicious patterns detected.