Security audit

电脑维修智能助手

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed PC troubleshooting guide skill with no executable code, but users should be careful before following repair commands or hardware steps.

Install only if you want a Chinese-language PC repair troubleshooting assistant. Before following any command, disk repair, data recovery, OS reinstall, or hardware disassembly advice, back up important data, confirm the command's effect, and avoid risky steps if the device may have failing storage or warranty coverage.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented trigger phrases are very broad, everyday help-seeking statements such as describing a broken computer or asking for upgrade advice. In a host assistant that auto-loads skills from natural language, this can cause unintended activation, exposing users to unrequested guidance, increasing prompt-scope collisions with other skills, and creating opportunities for unsafe actions to be suggested in the wrong context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are broad enough to activate on common troubleshooting phrases like '黑屏', '死机', or '无法联网' even when the user did not explicitly request this repair skill. That can cause inappropriate routing, overcollection of device/problem details, and unsolicited repair guidance in ordinary conversations, increasing the chance of irrelevant or unsafe advice being injected into the interaction.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest description embeds an extensive trigger list containing ambiguous everyday phrases, which raises the chance of accidental invocation across unrelated chats. Because the skill gives technical repair instructions and may steer users into hardware actions, false activation can expose users to unnecessary risk and degrade safe intent routing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document includes diagnostic and repair commands such as netsh winsock reset, sfc /scannow, and chkdsk C: /f that can alter system configuration or trigger reboot-time disk operations, but it provides no warnings about required privileges, side effects, data loss risk, or when not to run them. In a PC repair skill, users are likely to follow these steps directly, which increases the chance of unintended system changes, service disruption, or risky actions on unstable or failing systems.

Static analysis

No suspicious patterns detected.