T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:100- Finding
Default Auto Mode May Execute a Spoofed Local Scanner
- Content
View full analysis
- Remediation
View remediation
Security audit
CMIC Skill Scanner (Linux ARM64)
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible security scanner, but it needs review because its default mode may run a locally resolved external scanner and its install path depends on missing or unpinned artifacts.
Install only after reviewing the external scanner and build source you intend to run. Prefer --engine native for routine scans, avoid running this as an elevated user, verify any binary from an independent trusted source, and use --upload-url or --use-llm only with approved endpoints because findings or target text may leave the machine.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Build Instructions Execute Code from an Unpinned Mutable Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - CMIC does NOT upload reports unless you configure `--upload-url` - CMIC does NOT configure an LLM endpoint unless you set `--use-llm` - `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that - Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan ## 工作流程
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide documents optional LLM review that sends package-derived content to an OpenAI-compatible endpoint, and for external mode delegates packet construction to a child scanner. Even though it mentions bounded/redacted text for native mode, this is still external transmission of analyzed content not reflected in the stated local-audit purpose, creating data leakage and trust-boundary risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation guide advertises an upload mode that sends embedded review details, full scan summaries, and findings to a remote URL, while the skill description frames the tool as a local audit wrapper. That mismatch can cause operators to disclose sensitive package metadata or findings externally without fully appreciating that the tool supports network exfiltration of scan results.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The upload example normalizes sending full scan summaries and findings to a remote endpoint without a clear warning that results may contain sensitive internal paths, package content characteristics, or security-relevant findings. Users may copy-paste the example into enterprise workflows and unintentionally disclose information to external services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description is written in Chinese while the skill name and much of the rest of the document are in English, and there is no indication that the skill is intentionally limited to Chinese-speaking users or that language selection is optional. This can violate a language/locale policy that requires user choice or documented justification for locale constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest text for the skill description and default prompt is entirely in Chinese, which implies a fixed language/locale for interaction. The file does not indicate any user opt-in, alternative language support, or justification for a Chinese-only constraint.
- Content