Security audit

Agent Security Skill Scanner Gitee

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a security scanner, but its artifacts have enough scope, persistence, and reliability problems that users should review it before installing.

Install only after reviewing the code and treating it as a Review item: do not rely on the advertised detection-rate claims without independent testing, do not enable LLM/webhook/email analysis for sensitive code unless you control the endpoint and understand what is sent, and avoid daemon/cron/systemd operation unless you have verified the exact command and removal path.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The user guide for a purported security scanner documents materially broader operational capabilities, including orchestration, benchmarking, fault tolerance, and daemonized services. This scope expansion is dangerous because users may grant the skill elevated trust and permissions appropriate for a scanner while it also supports persistent or multi-step execution behavior outside that core purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented task orchestrator accepts arbitrary shell commands such as "echo step1" and "echo step2", indicating a generic command-execution surface unrelated to simple code scanning. In an agent skill context, this can be abused to execute attacker-controlled commands under the guise of a security scan, especially if the skill is invoked with filesystem, network, or CI/CD privileges.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: A health-check daemon introduces persistence and background execution behavior that is not an obvious requirement for a code security scanner. In a skill ecosystem, daemonized behavior increases risk because it may continue running, monitor the environment, or consume resources beyond the user's immediate scanning request.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documented workflow includes sending notifications as part of orchestrated tasks, showing the skill can participate in broader automation rather than only performing local analysis. This increases danger because a security-scanner-branded skill may be trusted to read sensitive code and could then be repurposed to trigger external actions or data flows as part of notifications or multi-step workflows.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The validator modifies sys.path and imports MultiLanguageScanner from the release directory, which executes arbitrary module top-level code during validation. If an attacker can place or alter files in the release package, running the validator becomes a code-execution path under the operator's privileges, making this dangerous in a supply-chain or pre-release workflow.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The code unconditionally marks every scanned file as detected malicious without parsing the scanner output, creating systematically false security results. In a security-scanner skill, this is especially dangerous because downstream users may trust fabricated detection rates, corrupt evaluations, and make bad triage or deployment decisions based on invalid data.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The whitelist/blacklist logic is security-relevant and the implementation explicitly lets any whitelist match short-circuit blacklisted content. Because the whitelist contains broad substrings such as '# normal_script' and 'print("Hello, World!")', an attacker can prepend one of those markers to malicious content and force the scanner to downgrade or suppress detection.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs operators to configure an external LLM endpoint for scan analysis but does not warn that scan contents, prompts, file excerpts, or metadata may be transmitted off-system to a third-party service. In a security scanner context, that omission is material because the analyzed data may itself contain secrets, malware samples, customer code, or regulated information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The prompt builder sends source code and file metadata to an external LLM API path, which can expose proprietary code, secrets embedded in code, or sensitive internal paths to a third party. In a security-scanner skill, this is more dangerous because users may scan confidential or malicious samples and not expect that content to be transmitted externally.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/engine/smart_pattern_detector.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/engine/smart_pattern_detector.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: src/multi_language_scanner_v4.py:411