content-batch-processor（批量内容处理工具，支持文本格式化、摘要生成、关键词提取、文件格式转换等批处理操作，提升内容工作效率。）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:06 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a batch document-processing helper, but it asks for broader authority than its instructions justify and includes batch file-changing examples without clear safeguards.

Review this skill carefully before installing. It appears intended for Chinese-language batch document work, but you should only use it in a constrained workspace, avoid giving it general command-execution authority unless truly needed, and require confirmation or separate output folders before bulk overwriting or renaming files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: config.json:22

Finding

Unnecessary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: config.json, lines 22–29
Vulnerability Type: Excessive system capability
Risk Level: Medium

Vulnerable Configuration

json

"capabilities": [
  "read",
  "write",
  "edit",
  "exec",
  "pdf",
  "image"
]

Technical Analysis

The Skill requests the exec capability, which can permit operating-system command execution. The documented functionality in SKILL.md consists of reading, formatting, summarizing, translating, converting, writing, and renaming content. No documented workflow requires shell-command execution, and the SKILL.md front matter does not list exec as a required tool.

Consequently, granting exec exceeds the Skill's stated operational requirements and violates the principle of least privilege. Although the reviewed package contains no executable scripts or direct malicious command, this unnecessary permission expands the potential impact of attacker-controlled content, unsafe future instructions, or an Agent decision that causes command execution.

Attack Path

1. The Skill is installed or activated with the capabilities declared in config.json.
2. The runtime grants the Agent access to the unnecessary exec capability.
3. The Agent processes attacker-controlled content or receives a later instruction that influences its tool selection.
4. The influenced Agent invokes exec with an unsafe command.
5. The command executes with the operating-system privileges and environmental access available to the Agent process.

This is a capability-enabled attack path rather than evidence of an embedded payload; no direct invocation of exec was found in the audited files.

Impact Assessment

Successful exploitation could permit arbitrary local command execution within the privileges of the Agent process. Depending on runtime isolation and host permissions, this may expose readable files, allow modification or deletion of ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the capabilities array because no documented feature requires operating-system command execution.
2. Review every remaining capability against actual workflows and remove image as well unless a concrete image-processing feature requires it.
3. Restrict read, write, and edit operations to explicitly approved input and output directories.
4. Require user confirmation before overwriting, renaming, or deleting existing files.
5. If command execution becomes necessary in a future release, expose narrowly scoped operations instead of a general shell, use fixed executable and argument allowlists, reject shell metacharacters, apply sandboxing, and require explicit user approval.
6. Keep the capability declarations in config.json and the requirements documented in SKILL.md synchronized, and add an automated check that rejects undeclared or unjustified privileges.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes examples for batch overwriting and renaming files in place without guardrails, backups, dry-run guidance, or warnings about destructive effects. In an agent setting, users may copy these patterns directly, increasing the risk of accidental data loss or unintended modification of large sets of files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The only natural-language description presented to users is written in Chinese, with no indication that other languages are supported or that this is a region-specific tool. This can amount to an implicit language policy choice without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and generic, including terms like '文本处理', '格式化', and 'batch process', which are likely to match ordinary user requests not specifically intended for this skill. Over-broad activation increases the chance that a high-privilege skill is selected in inappropriate contexts, potentially exposing read/write/edit/exec capabilities during routine assistance tasks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest requests powerful capabilities such as exec, pdf, and image processing even though the stated purpose is batch text/content processing. This expands the attack surface significantly: if the skill is invoked on untrusted input or chained into other workflows, unnecessary execution and file/media handling rights could enable command execution, unsafe file transformations, or access to sensitive local content beyond the expected text-only scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill name and summary are written entirely in Chinese, which signals a fixed language choice in the user-facing metadata. In this file there is no indication that users can choose their language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy criteria, forcing a specific language without documented choice or justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language content of the skill, including the description and usage examples, is entirely in Chinese, and there is no indication that the skill is intentionally region-specific or that users may choose another language. This can violate language/locale policy when a skill imposes a single language without opt-in or justification.

Content

No source excerpt is available for this finding.