德胧竞品分析报告

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it requests general shell access that is broader than needed for making competitor reports.

Review this before installing if your agent can run shell commands. The report-writing behavior is expected, but the skill would be safer if Bash were removed or tightly scoped and if it checked before overwriting existing output files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Unrestricted Shell Access Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable code snippet:

yaml

---
name: competitor-analysis-report
description: Generate structured competitive analysis reports with feature comparisons, pricing analysis, SWOT, and strategic recommendations. Use when analyzing competitors, creating market research reports, or delivering competitive intelligence for clients.
argument-hint: "[business-or-product] [competitor1] [competitor2] [competitor3]"
allowed-tools: Read, Write, Edit, Grep, Glob, Bash, WebFetch, WebSearch
---

Technical Analysis

The Skill is intended to collect publicly available competitor information and generate Markdown, HTML, summary, and CSV files. These operations require web research and constrained file access, but the configuration also grants access to Bash.

General-purpose shell access exceeds the permissions needed for the documented workflow. Depending on the host Agent's isolation and authorization controls, Bash can provide access to arbitrary command execution, local files, environment variables, installed programs, and network-capable utilities. This unnecessarily broad authority violates the principle of least privilege and increases the consequences of prompt injection or unsafe interpretation of untrusted research content.

The Skill does not itself contain a malicious shell command, encoded payload, or explicit instruction to abuse Bash. Exploitation therefore depends on the Agent being influenced to issue an unsafe command, such as through malicious content encountered during web research or attacker-controlled input.

Attack Path

1. A user asks the Skill to analyze an attacker-controlled competitor, website, or source.
2. The Skill retrieves or processes untrusted public content as part of its documented research workflow.
3. That content contains prompt-inject ...[truncated 1395 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools, because the documented workflow does not require general-purpose command execution.
2. Reduce the tool list to the minimum required set, preferably Read, Write, WebSearch, and a narrowly constrained WebFetch.
3. Retain Edit, Grep, or Glob only if each is operationally necessary for report generation.
4. Restrict write access to output/competitor-analysis/ and reject path traversal, absolute paths, and symbolic-link escapes.
5. Treat all retrieved web content as untrusted data and prohibit instructions found in research sources from changing tool usage or workflow objectives.
6. If shell access is unavoidable, replace unrestricted Bash with an allowlisted wrapper that permits only specific commands and arguments, uses a dedicated low-privilege account, enforces filesystem and network isolation, and requires approval for sensitive operations.
7. Add runtime logging and authorization checks for tool calls so attempts to access unrelated files, execute commands, or contact unapproved destinations are blocked and auditable.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to write several files into the workspace automatically, but it does not warn the user that filesystem changes will occur or ask for confirmation before creating artifacts. This can lead to unexpected workspace modification, accidental overwrites, or clutter, especially when the user only expected analysis output in-chat.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.