Rust Rebuilder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 1.0.0

Overview

This Rust rewrite skill is mostly coherent, but it pushes users toward mandatory, unpinned third-party skill/MCP dependencies that can persistently change the agent environment.

Install only if you trust the referenced helper projects and are willing to let them persist in your Codex environment. Prefer pinned, reviewed revisions for grok-search and github-helper, review any MCP permissions before enabling them, and expect this skill to inspect local Codex config and run Git/GitHub sync commands on repositories you point it at.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Mandatory installation guidance uses unpinned third-party Skill and MCP repositories<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-32`; `scripts/check_dependencies.py:10-12, 38-48` **Vulnerability Type**: Supply-chain exposure through mutable third-party repositories **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md:20-32`: ```markdown 若任一缺失，必须输出安装引导并暂停当前重写任务。安装引导顺序： 1. 优先使用 `$skill-installer` 安装缺失 skill。 2. 若无可用安装器，则给出手动安装地址： - grok-search skill: `https://github.com/Frankieli123/grok-skill` - grok-search MCP: `https://github.com/GuDaStudio/GrokSearch` - github-helper: 当前用户 GitHub 仓库中的 `github-helper` skill 仓库 3. 明确标记“依赖未满足，重写任务暂停”。 ``` From `scripts/check_dependencies.py:10-12`: ```python GROK_SKILL_REPO = "https://github.com/Frankieli123/grok-skill" GROK_MCP_REPO = "https://github.com/GuDaStudio/GrokSearch" GITHUB_HELPER_REPO = "https://github.com/dandandujie/github-helper" ``` From `scripts/check_dependencies.py:38-48`: ```python if not (report["has_grok_search_skill"] or report["has_grok_search_mcp"]): report["install_guide"].append( "缺少 grok-search（skill 或 mcp）。skill 仓库: " f"{GROK_SKILL_REPO}；mcp 仓库: {GROK_MCP_REPO}" ) if not has_helper_skill: report["install_guide"].append( "缺少 github-helper skill，请先安装后再执行重写。仓库地址: " f"{GITHUB_HELPER_REPO}" ) ``` ### Technical Analysis The dependency preflight makes external Skills or an MCP server mandatory and directs the user or agent to install them from GitHub repository URLs. These references are not pinned to reviewed commit hashes, immutable release artifacts, signed tags, or verified checksums. Consequently, the code or instructions ultimately installed can change after this Skill has been reviewed. The Skill documentation is also inconsistent about the source of `github-helper`: `SKILL.md` describes a repository belonging to the current user, while the Python script supplies a fixed third-party repository. This inconsistency increases the chance that an u ...[truncated 2028 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every external dependency to an immutable, reviewed commit hash or versioned release artifact. 2. Publish and verify SHA-256 or stronger cryptographic hashes for downloaded artifacts. 3. Prefer signed releases or signed Git tags and document the trusted signer identities. 4. Maintain an explicit allowlist of approved Skill and MCP sources. 5. Require informed user confirmation before any external Skill or executable MCP component is installed. 6. Make the `github-helper` source consistent between `SKILL.md` and `check_dependencies.py`. 7. Extend the preflight report to include the expected repository, pinned revision, checksum, and verification status. 8. Review dependency updates before changing pins; do not automatically follow mutable default branches. 9. Run MCP components with least privilege, restricting filesystem, environment, credential, tool, and network access to what the rewrite task requires. 10. Treat installed Skill text as executable policy content and review it for instruction hijacking before activation. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a broad Rust migration/orchestration capability, including project rewrite planning, parity verification, idiomatic guidance, latest Rust feature checks, and GitHub upstream synchronization. The supplied code does none of those things. It simply checks for the presence of certain locally installed skills/MCP configuration entries and prints a readiness report with repository links for missing dependencies. While dependency preflight checks are mentioned in the description, this code is only that small supporting piece and does not substantiate the much broader declared primary purpose. Therefore the description materially overstates what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The code’s actual behavior is narrowly focused on Git repository synchronization reporting. It runs git commands to validate a repo, ensure `upstream` and `origin` remotes exist, fetch updates, count ahead/behind commits between `upstream/<branch>` and `origin/<branch>`, and list recent upstream-only commits. While the declared description mentions GitHub upstream synchronization as one component, the overall declared purpose is primarily a Rust porting/rewrite assistant with multiple migration-related capabilities that are entirely absent here. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to read local files and execute shell commands (`python3 scripts/check_dependencies.py`, other referenced scripts) but does not declare an explicit tool scope such as `permissions` or `allowed-tools`. In an agent ecosystem, undeclared capabilities reduce reviewability and can cause an agent to perform filesystem or command execution beyond what a user or platform expects.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill instructions are written as direct operational guidance in Chinese and the trigger example also requires Chinese phrasing, but there is no statement that the user may choose another language. This creates a natural-language locale constraint without opt-in, which matches the policy violation category for language or locale restrictions.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains the operational instructions entirely in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when they are documented and justified or when the user is given a language/locale choice, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The guideline explicitly mandates a specific language/locale ('在重写后端 Rust 代码时，严格遵循本规范'), which can cause the agent to respond in Chinese regardless of the user's preferred language. In a code-rewrite skill, this can degrade usability, create misunderstandings in technical migration guidance, and conflict with user or system language expectations.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, which effectively forces a specific language/locale without any opt-in or documented regional justification. Under the policy, language constraints are only acceptable when the skill offers a choice or clearly documents why the locale restriction is necessary.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script blocks the Rust rewrite workflow unless unrelated external components are installed: a grok-search skill or MCP entry, and a github-helper skill. This creates unjustified dependency coupling to third-party repositories outside the skill’s stated purpose, expanding the trust boundary and pressuring users to install additional code that may have broad access to local files, repositories, or network resources.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code emits install guidance strings only in Chinese, which imposes a specific language on users without opt-in. The file does not indicate that the skill is region-specific or provide any mechanism to select another language.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_git(repo_path: Path, args: list[str]) -> str:
    command = ["git", *args]
    result = subprocess.run(
        command,
        cwd=repo_path,
        check=False,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains multiple user-facing messages and CLI help text in Chinese, including error messages and argument descriptions. Because the skill does not offer a language/locale option or document that it is intentionally region-specific, it appears to force a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: This markdown file is primarily written in Chinese and does not indicate that users may choose another language or locale. Under the policy criteria, forcing a specific language without user opt-in can be considered a natural-language policy violation.

Static analysis

No suspicious patterns detected.