Back to skill

Security audit

磁盘空间盘点与清理建议

Security checks across malware telemetry and agentic risk

Overview

This disk cleanup skill is mostly coherent, but it includes real deletion tooling and broad local inventory reporting that are not scoped as carefully as its safety language implies.

Install only if you are comfortable with a skill that scans broad local paths and writes detailed reports containing usernames, hostnames, and file paths. Treat all generated cleanup commands as dangerous: review exact paths, prefer reversible trash/recycle-bin actions, and do not run cleaner.py or batch commands unless you have backups and fully understand what will be removed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions even though its documented behavior requires environment access, filesystem reads/writes, and shell command generation/execution paths. This creates a trust and review gap: operators may authorize or invoke the skill without understanding that it can touch local files and produce destructive shell commands.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documentation repeatedly claims the skill is report-only and 'never auto-deletes,' yet the described package includes cleaner.py and command paths for direct deletion, permanent deletion, and bulk cleanup. This mismatch is dangerous because users and reviewers may treat the skill as low risk while it actually supports destructive actions, increasing the chance of unintended data loss or unsafe invocation.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The claim that scanner.py contains 'no write operations' conflicts with the documented generation of JSON and HTML report files on disk. Even if the writes are only report outputs, inaccurate safety claims mislead users and security reviewers about side effects and can cause the tool to be run in environments where writes are not acceptable.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill repeatedly emphasizes that it never auto-deletes, but the documented cleaner.py component introduces actual cleanup behavior beyond merely suggesting commands. This inconsistency can cause users to overtrust the skill and execute or expose deletion functionality they did not expect.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill manifest promises 'NEVER auto-deletes', but this script performs real destructive actions, including permanent deletion and bulk cleanup. That mismatch is security-relevant because users, hosts, or reviewers may grant trust and permissions based on the analyzer-only description, while the code can remove data when invoked.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The module docstring states the script is a cleaner called from the HTML report, which indicates a direct execution path from reporting UI to destructive actions. In the context of a skill advertised as non-deleting, this hidden coupling increases the risk of unsafe user assumptions and accidental triggering of file removal.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This code exposes permanent deletion of arbitrary files and directories via a path argument, which exceeds the stated analyzer/report scope of the skill. Because deletion is irreversible and accepts user-supplied paths without policy restrictions, misuse or accidental invocation can cause substantial data loss.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Bulk cleanup of all 'green' items from a JSON file creates an automated deletion workflow, enabling many files to be removed in one action. In this skill context, that is especially dangerous because the product is described as an analyzer that only outputs recommendations, so users may not expect the code to execute destructive cleanup at scale.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill probes Desktop, the home directory, and even D: for .git repositories to infer development projects, which broadens collection beyond obvious cleanup targets. In an agent context, this creates unnecessary filesystem discovery and may expose sensitive project names, locations, and codebase structure in generated reports.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
Invoking the Docker CLI inspects host container/image/volume state, which can reveal sensitive environment details such as project usage, image inventory, and storage patterns. While not command injection, this is privileged host introspection beyond minimal disk scanning and increases data exposure in the report.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The template tells users the report will not auto-delete files, but then explicitly encourages them to ask the agent to execute the generated cleanup commands. Because the same report also generates destructive shell commands such as rm, rm -rf, Remove-Item, and Docker prune operations, this creates a dangerous trust boundary collapse where advisory output can become agent-executed actions.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Broad triggers like 'disk cleanup,' '磁盘空间,' or '哪些可以删' can cause the skill to activate in ordinary conversations where the user may only want advice, not local scanning or command generation. In a storage-cleaning context, accidental invocation is more dangerous because the skill can enumerate local files and present destructive commands.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger section explicitly permits fuzzy matching but does not define scope, exclusions, or a confirmation handshake. That increases the chance of unintended activation on vague storage-related requests, which is risky given the skill's ability to inspect user directories and produce deletion commands.

Missing User Warnings

High
Confidence
99% confidence
Finding
Permanent deletion occurs with no confirmation prompt, no preview of targets, and no explicit warning that the action is irreversible. This makes accidental invocation far more likely to result in immediate data loss, especially when the skill is presented as a storage analyzer rather than a deletion utility.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The report exports detailed local filesystem paths, disk usage, hostname, username, and large/old file listings into JSON and HTML without an explicit warning or consent at the point of persistence. In an agent skill, that creates a privacy risk because sensitive local inventory is written to disk in a reusable format that other local users or processes may access.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
mv "/path/to/cache" ~/.Trash/

# 彻底删除(不可恢复)
rm -rf "/path/to/cache"

# 清空废纸篓
rm -rf ~/.Trash/*
Confidence
97% confidence
Finding
rm -rf "/path/to/cache" # 清空废纸篓 rm -rf ~

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| 等级 | 含义 | 典型内容 | 命令类型 |
|------|------|----------|----------|
| 🟢 立即清 | 纯缓存、临时文件,删了不影响使用 | 系统临时文件、浏览器缓存、pip/npm缓存、日志 | `rm -rf` / `Remove-Item` / `mv ~/.Trash/` |
| 🟡 确认后清 | 可能需要但占用大的文件 | Downloads、Desktop、node_modules、构建产物、Docker镜像 | `rm -rf` (带警告) + 打开目录命令 |
| 🔴 保留 | 系统文件、应用核心数据,绝不能删 | Windows/System、/usr、程序安装目录、AppData核心 | 只展示大小,不提供删除命令 |
Confidence
94% confidence
Finding
rm -rf` / `Remove-Item` / `mv ~/.Trash/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Windows (cmd)
```cmd
# 删除目录
rmdir /s /q "C:\path\to\cache"

# 清空回收站
rd /s /q C:\$Recycle.Bin
Confidence
95% confidence
Finding
rmdir /s /

Tool Parameter Abuse

High
Category
Tool Misuse
Content
mv "/path/to/cache" ~/.Trash/

# 彻底删除(不可恢复)
rm -rf "/path/to/cache"

# 清空废纸篓
rm -rf ~/.Trash/*
Confidence
97% confidence
Finding
rm -rf "/path/to/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
rm -rf "/path/to/cache"

# 清空废纸篓
rm -rf ~/.Trash/*
```

---
Confidence
96% confidence
Finding
rm -rf ~/.Trash/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.