CMIC Skill Scanner (macOS ARM64)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 0.11.1

Overview

This is a disclosed local skill scanner, but its package integrity is inconsistent because the advertised executable and checksum are missing and the fallback source build is unpinned.

Do not treat this package as fully installable as-is unless you obtain and verify the missing binary and checksum from a trusted release, or build from a pinned and reviewed source revision. Use --engine native to avoid an external scanner, and enable --upload-url or --use-llm only with trusted endpoints after considering that reports or sampled target text may contain sensitive information.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:21

Finding

Unpinned Remote Source Retrieval Allows the Reviewed Implementation to Change

Content

View full analysis

Remediation

View remediation

cargo build --release --locked ``` 2. Publish and document a cryptographically signed release tag, and require users to verify its signature before building. 3. Include the promised binary and checksum file in the package: - `assets/bin/skillscan` - `assets/build/skillscan.sha256` 4. Verify during packaging that the bundled binary's SHA-256 digest matches both the checksum file and `assets/build/build-info.json`. Fail the build if any artifact is absent or inconsistent. 5. Include `Cargo.lock` in the reviewed source release and require `cargo build --release --locked` so dependency resolution cannot silently change. 6. Prefer a source archive tied to the reviewed commit and publish its SHA-256 digest through an independently authenticated release channel. 7. Update the installation instructions so checksum verification is mandatory rather than optional, and instruct users not to execute the binary when an artifact or checksum is missing. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- CMIC does NOT upload reports unless you configure `--upload-url`
- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`
- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that
- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan

## 工作流程

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installation guide instructs users to upload scan results to a remote URL and explicitly states that the payload includes full scan summaries and findings, but it does not prominently warn about potential disclosure of sensitive package contents, metadata, or internal security findings. In a security-scanning context, these reports may contain confidential information about proprietary skills or vulnerabilities, so sending them off-host without clear privacy guidance creates a real data exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description is written in Chinese and presents the skill purpose to the user without any opt-in or alternate language. This can violate a language/locale policy when a skill constrains user-facing interaction to a specific language without choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation/use guidance at this line is user-facing natural language and is only in Chinese. Because the file otherwise mixes English and Chinese, the skill does not clearly offer a language choice and may impose a locale constraint inconsistently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest text in short_description and default_prompt is written only in Chinese, which implies a fixed language experience for users. There is no indication of language selection, opt-in, or justification that this skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Core instructional sections such as prerequisites and workflow are partially labeled in Chinese, which can limit accessibility for users who did not choose that locale. The file does not state that it is region-specific or provide a language selection mechanism.

Content

No source excerpt is available for this finding.