skill-lint

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:10 AM UTC
• Version: 2.8.0

Overview

This skill is a disclosed linting and review tool whose local scanning, optional vulnerability lookup, and controlled checker execution fit its stated purpose.

Installers should understand that this is an active review tool: static scans are low risk, but formal verification can execute checker scripts from the candidate skill. Use dynamic verification only for your own or already trusted candidates, or run it in an isolated environment for third-party code. Avoid archiving reports that contain customer, case, credential, or private repository details unless they are sanitized.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (108)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is broad skill linting and reliability review, but the documented behavior includes concrete security scanning, candidate verification workflows, and operational audit steps that materially expand what the skill does. This mismatch is dangerous because users may authorize the skill under a narrower mental model than its actual behavior, especially given the presence of shell/network/file capabilities and instructions to run audit scripts.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

- 单个 Skill 目录：目标目录自身包含 `SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

python3 scripts/security_scan.py audit --candidate-root /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

python3 scripts/security_scan.py audit --candidate-root /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

python3 scripts/security_scan.py audit --candidate-root /path/to/skill

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

python3 scripts/harness_failure_audit.py audit \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

python3 scripts/harness_failure_audit.py audit \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

python3 scripts/harness_failure_audit.py audit \

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/instruction-stability-standards.md (reported line 44)May include surrounding context.

md

需要声称“指令遵循稳定”“多轮不漏项”或“产出没有关键漂移”时：

1. 为权威来源中的每条 hard constraint 分配稳定 ID，并在要求旁加入唯一锚点，例如 `<!-- skill-lint:constraint REPORT-COVERAGE -->`。
2. 复制 `config/instruction-stability-contract.example.json` 为目标 Skill 内的 `config/instruction-stability-contract.json`，用 `SKILL.md#REPORT-COVERAGE` 这类 source ref 双向绑定全部锚点、checker、产物阶段、正反例和历史回归。合同的 `skill.version` 可对应 frontmatter 顶层 `version` 或官方兼容的 `metadata.version`；两处并存时必须一致。
3. 由候选外 evaluator 按 `config/instruction-stability-requirements-baseline.example.json` 形成硬约束基线；其 candidate SHA-256、`requirement_sources`、`requirement_exclusions`、hard constraint IDs 和 source refs 必须与当前候选、锚点及合同完全相同。门禁自动发现 `SKILL.md` 与 `references/**/*.md` 中含硬要求信号的文件；每一份都必须进入 sources，或由 evaluator 在签名 exclusions 中逐项说明理由，不能静默漏掉整份规范。sources 中任何含“必须 / 不得 / 禁止 / 应当 / 务必 / must / shall / never”的规范行，都必须在同一行或前一个非空行有唯一 marker。基线使用 evaluator 的 Ed25519 私钥在候选执行环境之外签名；正式门禁只取得受信公钥。合同存在但缺有效签名基线时仍是 `NOT_VERIFIED`。
4. 先按 `harness-reliability-standards.md` 生成并填写候选外 Harness review evidence。正式稳定性门禁只允许当前正在执行的受信 `skill-lint` 作为 policy root，并亲自复算该 evidence；候选不能替换门禁，仅在合同里自填 `independent_from_producer=true` 也不构成独立性证明。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/instruction-stability-standards.md (reported line 44)May include surrounding context.

md

需要声称“指令遵循稳定”“多轮不漏项”或“产出没有关键漂移”时:

1. 为权威来源中的每条 hard constraint 分配稳定 ID,并在要求旁加入唯一锚点,例如 `<!-- skill-lint:constraint REPORT-COVERAGE -->`。
2. 复制 `config/instruction-stability-contract.example.json` 为目标 Skill 内的 `config/instruction-stability-contract.json`,用 `SKILL.md#REPORT-COVERAGE` 这类 source ref 双向绑定全部锚点、checker、产物阶段、正反例和历史回归。合同的 `skill.version` 可对应 frontmatter 顶层 `version` 或官方兼容的 `metadata.version`;两处并存时必须一致。
3. 由候选外 evaluator 按 `config/instruction-stability-requirements-baseline.example.json` 形成硬约束基线;其 candidate SHA-256、`requirement_sources`、`requirement_exclusions`、hard constraint IDs 和 source refs 必须与当前候选、锚点及合同完全相同。门禁自动发现 `SKILL.md` 与 `references/**/*.md` 中含硬要求信号的文件;每一份都必须进入 sources,或由 evaluator 在签名 exclusions 中逐项说明理由,不能静默漏掉整份规范。sources 中任何含“必须 / 不得 / 禁止 / 应当 / 务必 / must / shall / never”的规范行,都必须在同一行或前一个非空行有唯一 marker。基线使用 evaluator 的 Ed25519 私钥在候选执行环境之外签名;正式门禁只取得受信公钥。合同存在但缺有效签名基线时仍是 `NOT_VERIFIED`。
4. 先按 `harness-reliability-standards.md` 生成并填写候选外 Harness review evidence。正式稳定性门禁只允许当前正在执行的受信 `skill-lint` 作为 policy root,并亲自复算该 evidence;候选不能替换门禁,仅在合同里自填 `independent_from_producer=true` 也不构成独立性证明。

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/security-assessment-standards.md (reported line 76)May include surrounding context.

md

| 类别 | 说明 | 默认级别 |
|------|------|----------|
| 命令执行 | `subprocess`、`os.system`、shell 管道、Node 子进程等可执行任意命令的能力 | 严重 / 警告 |
| 下载并执行 | `curl | sh`、`wget | bash`、远程脚本下载后运行 | 严重 |
| 权限提升 | `sudo`、`chmod 777`、setuid、系统服务修改、绕过安全软件 | 严重 |
| 文件删除或破坏 | 递归删除、覆盖用户目录、无确认删除大量文件 | 严重 |
| 敏感文件访问 | `.env`、SSH/AWS/GPG 密钥、系统配置、用户 shell 配置 | 严重 / 警告 |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/security-assessment-standards.md (reported line 76)May include surrounding context.

md

| 类别 | 说明 | 默认级别 |
|------|------|----------|
| 命令执行 | `subprocess`、`os.system`、shell 管道、Node 子进程等可执行任意命令的能力 | 严重 / 警告 |
| 下载并执行 | `curl | sh`、`wget | bash`、远程脚本下载后运行 | 严重 |
| 权限提升 | `sudo`、`chmod 777`、setuid、系统服务修改、绕过安全软件 | 严重 |
| 文件删除或破坏 | 递归删除、覆盖用户目录、无确认删除大量文件 | 严重 |
| 敏感文件访问 | `.env`、SSH/AWS/GPG 密钥、系统配置、用户 shell 配置 | 严重 / 警告 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 380)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 385)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 405)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 380)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 385)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/skill-dev-guide.md (reported line 380)May include surrounding context.

md

- ❌ 不读取 ~/.env 或其他敏感配置
- ✅ 最小权限原则：只请求必要的工具权限
- ✅ 第三方依赖使用官方库
- ❌ **禁止使用 `rm -rf ~`、`rm -rf /`、`rm -rf $HOME` 等危险命令**
- ✅ **使用 `trash` 或安全删除脚本替代 `rm -rf`**

### (2) 安全删除规范

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/test_security_scan.py:139