AI收藏夹与桌面Dock 助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

The main skill looks like a local Command Compass card generator, but the package also includes agent-directed website modification instructions outside that purpose.

Review before installing. The local card-generation behavior is mostly disclosed and conservative, but the package should not be loaded into an agent with write access to website repositories or deployment artifacts unless you intentionally want the website migration instructions executed. Prefer a release that excludes WEBSITE_AGENT_INSTRUCTIONS.md or clearly marks it as non-runtime development documentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: WEBSITE_AGENT_INSTRUCTIONS.md:1

Finding

Bundled instructions redirect an AI agent to modify an unrelated website codebase

Content

View full analysis

Files requiring particular attention: - D:\MyFiles\Work\javisHUD\\data\card-schema-v1.json - D:\MyFiles\Work\javisHUD\\data\command-vault.json - D:\MyFiles\Work\javisHUD\\api\_lib\store.js - D:\MyFiles\Work\javisHUD\\api\cards\search.js - D:\MyFiles\Work\javisHUD\\api\favorites.js - D:\MyFiles\Work\javisHUD\\RESOURCE_HOUND_INTEGRATION.md - D:\MyFiles\Work\javisHUD\\assets\wboke-site.js ``` The remainder of `WEBSITE_AGENT_INSTRUCTIONS.md:29-314` directs the agent to modify schemas, API normalization, search and favorites endpoints, add new authenticated API endpoints, change storage behavior, and replace the website's downloadable skill archive. The instruction is made operational by `COMMAND_COMPASS_SKILL_ADAPTATION_REPORT.md:110`, translated as: ```text The website Agent can follow WEBSITE_AGENT_INSTRUCTIONS.md to complete the website-side API and schema alignment. ``` ### Technical Analysis The skill de ...[truncated 3011 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · WEBSITE_AGENT_INSTRUCTIONS.md (reported line 140)May include surrounding context.

md

- `GET /api/favorites`
- `POST /api/favorites`
- `DELETE /api/favorites`

要求：

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill name includes a 'zh' locale marker and the description is entirely in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This can violate language/locale policy when a skill implicitly requires a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and all operational instructions are written exclusively in Chinese, with no indication that the user or operator may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest presents user-facing titles, summaries, tags, categories, and instructions entirely in Chinese, including direct instructions to the assistant. Under the policy, language constraints should not be forced unless the skill offers a language choice or clearly documents a justified locale restriction, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The second card's user-facing metadata and instruction text are entirely in Chinese and direct the interaction in that language. The file does not provide any alternative language option or explain that the skill is region- or locale-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The third card's title, summary, tags, category, and instruction are all written in Chinese, implying a fixed interaction language. Because no opt-in, alternate locale, or justified regional limitation is stated, this conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file uses Chinese for all instructions and reporting content, which can amount to a language-policy constraint if users are not given an option to choose their preferred language. The file does not state that it is intended only for a Chinese-speaking or region-specific audience, nor does it offer an opt-in or alternative locale.

Content

No source excerpt is available for this finding.