Security audit

技能随行官

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it would globally alter every assistant reply and ships an under-documented local logging script, so users should review it before installing.

Install only if you explicitly want an always-on Chinese skill-usage footer on every assistant response. Avoid using it in workflows that require exact JSON, code-only output, privacy-sensitive logs, or reliable audit records unless it is revised to be opt-in, accurately scoped, and to store logs in a private per-user location.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Global Response Manipulation Through Automatically Loaded Skill Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report_skills.py:9
Finding: Predictable Shared Temporary File Allows Symlink-Based File Corruption and Log Tampering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to automatically inspect invoked skills on every reply and append a report, but the provided content is only prompt instructions and cannot reliably perform that enforcement or verification. This mismatch is dangerous because it creates false assurances about monitoring while potentially hiding undeclared behavior such as logging or stateful management mentioned by the analyzer.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction that every response must append a tracking block makes the skill effectively always-on and unconstrained. Broad activation like this can override normal assistant behavior, leak internal workflow details across unrelated conversations, and create a persistent channel for prompt-level interference.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The required appended output is fixed as the Chinese phrase '--- 本轮使用技能 ---', and the document provides all mandated reporting text only in Chinese. This imposes a specific language on all responses regardless of user preference, which is a natural-language locale policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring states '每次汇报本轮AI回复使用了哪些专项技能', implying it identifies skills used in the current reply. However, get_recent_tools_from_history() explicitly returns an empty list and is unused, while main('add') records whatever JSON array is passed on the command line, so the code does not itself discover actual current-turn skill usage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring states '每次汇报本轮AI回复使用了哪些专项技能', and the rest of the user-facing strings are also hard-coded in Chinese. This imposes a specific language/locale on the skill's outputs without offering a user choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill automatically analyzes the actual specialized skills used in the current AI reply and appends a report at the end, without command triggering. In contrast, this script cannot inspect the current turn, exposes explicit CLI commands ('add', 'report', 'clear'), and generates aggregate historical statistics from a local JSON log across turns rather than an automatic per-reply report.
Content: No source excerpt is available for this finding.

Tainted flow: 'LOG_FILE' from os.environ.get (line 10, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 90% confidence
Finding: The log file path is derived from the TEMP environment variable and then used directly for writing. In a hostile or multi-tenant runtime, an attacker controlling TEMP could redirect writes to an unintended file or symlink target, causing file clobbering, data corruption, or disclosure through placement in an attacker-controlled location.
Content: Scanner excerpt · scripts/report_skills.py (reported line 34)May include surrounding context.
python
def save_log(log): """保存记录。""" try: with open(LOG_FILE, 'w', encoding='utf-8') as f: json.dump(log, f, ensure_ascii=False, indent=2) except Exception: pass

Static analysis

No suspicious patterns detected.