CMIC Skill Scanner (macOS ARM64)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 0.11.1

Overview

This is a disclosed local skill scanner, but its package integrity is inconsistent because the advertised executable and checksum are missing and the fallback source build is unpinned.

Do not treat this package as fully installable as-is unless you obtain and verify the missing binary and checksum from a trusted release, or build from a pinned and reviewed source revision. Use --engine native to avoid an external scanner, and enable --upload-url or --use-llm only with trusted endpoints after considering that reports or sampled target text may contain sensitive information.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:21
• Finding: Unpinned Remote Source Retrieval Allows the Reviewed Implementation to Change<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–30 **Vulnerability Type**: Unpinned remote payload retrieval and supply-chain risk **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown This bundled package includes a pre-compiled binary. You can still build from source if you prefer: ```bash git clone https://gitee.com/random_player/cmic-skill-scanner.git cd cmic-skill-scanner && cargo build --release ``` ``` ### Technical Analysis The documented source-build procedure clones the repository's current default branch without specifying a reviewed commit hash, signed tag, or release archive checksum. Consequently, the code retrieved when a user follows these instructions may differ from the implementation that existed when this skill package was audited. This risk is compounded by the audited package contents: the documented `assets/bin/skillscan` binary and `assets/build/skillscan.sha256` checksum file are absent. Although `SKILL.md` and `assets/build/build-info.json` state a checksum, no corresponding binary is present to validate. Users therefore cannot verify or inspect the claimed bundled executable and may be more likely to follow the mutable remote build instructions. The remote repository is not proven malicious by the available evidence. The vulnerability is the lack of immutable source pinning, which creates a time-of-check/time-of-use supply-chain boundary controlled by the remote repository or its hosting account. ### Attack Path 1. A user obtains this skill package and discovers that the documented bundled binary is absent. 2. The user follows the recommended source-build command in `SKILL.md`. 3. `git clone` retrieves the repository's current default branch rather than an audited revision. 4. An attacker who has compromised the repository, maintainer account, or relevant source-hosting path modifies the branch after this package was reviewed. 5. The user runs `cargo build --release`, compiling the attacker- ...[truncated 947 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin source retrieval to a specific full commit hash: ```bash git clone https://gitee.com/random_player/cmic-skill-scanner.git cd cmic-skill-scanner git checkout --detach <full-reviewed-commit-hash> cargo build --release --locked ``` 2. Publish and document a cryptographically signed release tag, and require users to verify its signature before building. 3. Include the promised binary and checksum file in the package: - `assets/bin/skillscan` - `assets/build/skillscan.sha256` 4. Verify during packaging that the bundled binary's SHA-256 digest matches both the checksum file and `assets/build/build-info.json`. Fail the build if any artifact is absent or inconsistent. 5. Include `Cargo.lock` in the reviewed source release and require `cargo build --release --locked` so dependency resolution cannot silently change. 6. Prefer a source archive tied to the reviewed commit and publish its SHA-256 digest through an independently authenticated release channel. 7. Update the installation instructions so checksum verification is mandatory rather than optional, and instruct users not to execute the binary when an artifact or checksum is missing. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

- CMIC does NOT upload reports unless you configure `--upload-url`
- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`
- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that
- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan

## 工作流程

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installation guide instructs users to upload scan results to a remote URL and explicitly states that the payload includes full scan summaries and findings, but it does not prominently warn about potential disclosure of sensitive package contents, metadata, or internal security findings. In a security-scanning context, these reports may contain confidential information about proprietary skills or vulnerabilities, so sending them off-host without clear privacy guidance creates a real data exposure risk.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The description is written in Chinese and presents the skill purpose to the user without any opt-in or alternate language. This can violate a language/locale policy when a skill constrains user-facing interaction to a specific language without choice or justification.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The activation/use guidance at this line is user-facing natural language and is only in Chinese. Because the file otherwise mixes English and Chinese, the skill does not clearly offer a language choice and may impose a locale constraint inconsistently.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest text in `short_description` and `default_prompt` is written only in Chinese, which implies a fixed language experience for users. There is no indication of language selection, opt-in, or justification that this skill is intentionally limited to a Chinese-speaking context.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: Core instructional sections such as prerequisites and workflow are partially labeled in Chinese, which can limit accessibility for users who did not choose that locale. The file does not state that it is region-specific or provide a language selection mechanism.

Static analysis

No suspicious patterns detected.