Security audit

Spider Web Trigger Network

Security checks for vulnerabilities and agentic risk

Overview

This is a real local skill-routing tool, but it indexes and can expose the full installed-skill inventory and has broad routing rules that may load the wrong skill from ordinary words.

Install only if you want a meta-router that inventories your installed skills. Rebuild or edit the trigger database before relying on it, remove generic triggers such as common English words and bare file extensions, and run the dashboard only on localhost in a trusted browser session.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This file exposes a comprehensive inventory of installed skills, their trigger phrases, reverse mappings, overlap data, and management-oriented metadata that goes beyond the minimum needed for single-query routing. That broad visibility increases reconnaissance value: any component or user with access to this dataset can enumerate capabilities, identify sensitive/admin skills, and craft prompts to intentionally invoke downstream skills.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The metadata section and top-level skill listings reveal the installed-skill set and counts, enabling straightforward environment enumeration. In a multi-skill agent system, installed-skill discovery can materially assist prompt-based targeting of privileged or risky skills such as skill management, storage cleanup, or publishing/automation capabilities.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad and map to common requests like '技能推荐', '匹配技能', and '哪个技能可以处理', increasing the chance of unintended activation. In a meta-routing skill with Read, Write, Bash, Skill, and task-management capabilities, accidental invocation can cascade into scanning installed skills, creating indexes, and loading other skills without a user intentionally choosing that behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This section instructs the skill to scan all installed skills and build a trigger database, but the user-facing description does not prominently warn that metadata from other skills will be collected and stored in JSON. That creates a transparency and privacy issue because users may not realize installed-skill names and trigger metadata are being aggregated into a searchable local index.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The dashboard advertises API endpoints that can return the full database and export it as JSON, but the description does not warn that this may expose a consolidated inventory of installed skills and trigger mappings. Even when bound to localhost, this increases information disclosure risk if another local process, browser context, or forwarded port can access the service.

Vague Triggers

High

Confidence: 95% confidence
Finding: The triggers at these lines are extremely broad terms that can appear in ordinary conversation, making accidental or adversarial activation likely. In a router that dispatches to other skills, generic triggers create prompt-hijacking and misrouting risk because unrelated user text can be interpreted as an invocation signal.

Vague Triggers

High

Confidence: 94% confidence
Finding: Single-word triggers like these are too vague to safely indicate amazon product research intent and are likely to collide with routine user language. Such collisions can be exploited to steer routing unexpectedly or cause noisy, incorrect skill selection that degrades trust and may expose downstream capabilities.

Vague Triggers

High

Confidence: 96% confidence
Finding: Everyday terms like spending and receiving verbs are highly likely to occur in benign chat, so this skill may activate when users are simply describing daily events. Because bookkeeping can involve financial records and state changes, accidental routing here is more dangerous than a harmless suggestion engine and could cause unintended data capture or transactions.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Generic care phrases like '怎么养' are not unique to plant care and can match many unrelated conversations. This mainly causes misrouting and accidental activation, though the impact is somewhat lower because the destination skill appears informational rather than administrative or destructive.

Vague Triggers

High

Confidence: 97% confidence
Finding: The single trigger '每日' is extremely non-specific and can appear in a wide range of unrelated requests. In a routing system this creates a strong accidental-invocation vector and allows attackers to pad prompts with common words to bias dispatch behavior.

Vague Triggers

High

Confidence: 95% confidence
Finding: Triggers like '全国' and '分数匹配' do not uniquely identify gaokao volunteer selection and are broad enough to match many unrelated topics. This can misroute education-sensitive conversations and makes targeted dispatch manipulation easier in mixed-domain chats.

Vague Triggers

High

Confidence: 96% confidence
Finding: Triggers such as '比分' and especially 'key' are generic and have no safe activation boundary for an NBA-specific skill. Because 'key' is common in technical and everyday English, it is a high-collision token that can create frequent false activations and deliberate routing abuse.

Vague Triggers

High

Confidence: 93% confidence
Finding: Autogenerated generic English triggers like 'create', 'you', 'remove', 'use', and 'detects' are effectively unusable as safe routing keys because they appear constantly in normal text. Their presence substantially increases accidental activation and provides a trivial method to influence router decisions across unrelated tasks.

Vague Triggers

High

Confidence: 95% confidence
Finding: Using broad terms like '技能' and file extensions such as 'pdf', 'docx', and 'xlsx' as triggers will collide with many ordinary requests involving files. In a router, such generic file-type triggers can hijack document-related workflows and send sensitive files to the wrong skill for processing.

Vague Triggers

High

Confidence: 95% confidence
Finding: Environment words like 'linux', 'chrome', 'vnc', and 'agent' are generic operational terms rather than user intents, so they can spuriously activate the publishing skill in many unrelated technical conversations. Because the destination appears to involve automation/attachment behavior, misrouting here could trigger unintended browser or publishing workflows.

Static analysis

No suspicious patterns detected.