电脑维修智能助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.0.0

Overview

This PC repair skill is mostly a guidance-only repair helper, but it needs review because some instructions weaken security controls or can change disks/system state without enough guardrails.

Review this skill before installing. If used, install only from a pinned reviewed release or verified checksum, do not broadly trust antivirus-detected tools, verify downloaded utilities from official sources, back up important data before disk or partition repairs, and ask for confirmation before running admin-level or rebooting commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:35

Finding

Mutable Remote Skill Installed into an Automatically Loaded Directory

Content

View full analysis

Vulnerability Details

File Location: README.md:35-45
Vulnerability Type: Unpinned remote Skill installation and automatic activation
Risk Level: Medium

bash

git clone https://github.com/bettermen/pc-repair.git ~/.workbuddy/skills/pc-repair

The subsequent installation instructions tell the user to restart WorkBuddy, after which the Skill is automatically loaded.

Technical Analysis

The installation command clones the mutable default branch of a remote Git repository directly into WorkBuddy's Skill-loading directory. It does not pin an immutable commit, verify a release signature or checksum, or require review of the retrieved files before activation.

Consequently, the content installed by a user can differ from the content covered by this audit. If the repository, maintainer account, or release process is compromised, an attacker could replace the reviewed Skill instructions with malicious instructions. Restarting WorkBuddy would then load the changed content automatically.

This is a supply-chain weakness rather than evidence that the currently audited repository contains a malicious payload.

Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or the repository's default branch.
2. The attacker modifies the Skill instructions or adds harmful components.
3. A user follows the documented git clone command.
4. Git retrieves the attacker's current default-branch content directly into ~/.workbuddy/skills/pc-repair.
5. The user restarts WorkBuddy as instructed.
6. WorkBuddy automatically loads the unreviewed, attacker-controlled Skill.
7. The malicious Skill can influence agent behavior and potentially invoke any capabilities made available to the Skill by the host.

Impact Assessment

Successful exploitation could grant the attacker control over the loaded Skill's instructions and behavior. The practical scope is bounded by WorkBuddy's permissio ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace default-branch cloning with installation from an immutable, reviewed commit hash or signed release tag.
2. Publish a SHA-256 checksum for each release artifact and require verification before installation.
3. Sign release tags or artifacts and document signature verification.
4. Download the Skill into a staging directory rather than directly into the active Skill directory.
5. Require users or the host application to review and approve changed Skill instructions before activation.
6. Disable automatic loading of newly installed or modified Skills until integrity and trust checks succeed.
7. Document the exact audited version so users can confirm that their installed copy matches it.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/tool_guide.md:339

Finding

Blanket Recommendation to Allowlist Antivirus Detections

Content

View full analysis

Vulnerability Details

File Location: references/tool_guide.md:339-343
Vulnerability Type: Unsafe endpoint-protection bypass guidance
Risk Level: Medium

The affected guidance states:

text

1. Download software only from official websites.
2. Prefer portable versions that do not require installation.
3. If antivirus software reports a false positive, add the program to the trust list.

Technical Analysis

The guide recommends adding detected software to the antivirus trust list without requiring verification of the executable's cryptographic signature, release checksum, publisher identity, or exact download origin.

Antivirus detections are not necessarily false positives. Even a normally legitimate utility can become dangerous if its website, distribution channel, update infrastructure, or downloadable artifact is compromised. Allowlisting suppresses a security control and can permit the detected program to execute without further intervention.

The risk is amplified because the guide recommends numerous third-party diagnostic, driver-management, stress-testing, system-installation, and data-recovery utilities. Several maintenance operations may also be run with administrative permissions.

Attack Path

1. A user follows the guide and downloads a recommended utility.
2. The download is malicious, substituted, compromised, or obtained from a misleading source.
3. Endpoint protection detects or blocks the file.
4. The user interprets the detection as a false positive based on the guide.
5. The user adds the file or application to the antivirus trust list.
6. The malicious program executes while endpoint protection is suppressed for the allowlisted object.
7. The program performs actions available under the user's current privileges; if launched as administrator for repair work, the impact may extend system-wide.

Impact Assessment

Exploitation could lead to arbitrary execution under ...[truncated 472 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket instruction to add detected programs to the antivirus trust list.
2. Tell users not to execute a detected file unless its provenance has been independently verified.
3. Provide exact official HTTPS download pages rather than relying only on domain names or search results.
4. Require validation of the executable's digital signature and expected publisher.
5. Publish or link to vendor-provided cryptographic checksums and explain how to verify them.
6. Recommend submitting suspicious files to the software vendor or security team instead of disabling protection.
7. If an exception is unavoidable, make it narrowly scoped, temporary, and limited to a verified file hash rather than an entire directory or publisher.
8. Advise users to preserve antivirus protection and use an isolated environment for uncertain diagnostic utilities.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions and usage guidance are presented in Chinese, which effectively forces a specific language for users reading or invoking the skill documentation. The file does not indicate user opt-in, multilingual support, or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples are broad enough to match ordinary computer-help queries such as general troubleshooting or upgrade advice, which can cause the skill to activate outside a narrowly intended scope. Unintended activation can steer users into this skill's guidance when another tool or neutral assistant behavior would be more appropriate, increasing the risk of mistaken advice or unnecessary workflow takeover.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description itself embeds a long, broad trigger list, increasing the chance that orchestration or matching systems will invoke the skill for generic computer-problem mentions. Because manifest metadata is often used early in routing, overly inclusive terms here can amplify accidental selection before deeper intent validation occurs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger conditions are broad and include common troubleshooting phrases such as '蓝屏', '黑屏', '电脑卡', and '无法联网', which can cause the skill to activate in situations where the user did not explicitly ask for this workflow. Unintended invocation can misroute user requests, inject irrelevant repair guidance, or cause the agent to prioritize this skill over better-scoped alternatives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file includes repair and diagnostic commands such as chkdsk C: /f, sfc /scannow, network stack reset, memory diagnostics requiring reboot, and partition/data-recovery tool guidance without adjacent warnings about possible downtime, reboot requirements, write activity, or the need to back up important data first. In a PC-repair skill, users are likely to follow instructions directly, so omission of safety caveats can lead to data loss, interrupted work, or worsened damage on failing disks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

该技能文件全文以中文撰写，未见任何提示说明这是面向特定中文用户群体，或允许用户选择其他语言。根据语言/locale 政策，若技能默认强制单一语言而无用户选择或明确正当性，应视为自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as operating in that language, while also listing some English triggers. There is no statement that users may choose their preferred language or locale, which can be a natural-language policy concern when the skill appears generally applicable rather than region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file forces a single language/locale in its natural-language content and does not indicate that Chinese is optional or that the skill is intentionally region-specific. Under the policy, language constraints should either be optional for users or clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The entire guide is written only in Chinese and includes Chinese-platform-specific guidance such as B站 searches, without any note that the skill is region- or language-specific or that other language options are available. Under the stated policy, a forced language/locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.