Security audit

Swcr Register

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned for preparing Chinese software copyright registration materials, but it needs review because it can read broad project contents, mishandle symlinks, and generate filing text that may be inaccurate.

Review before installing. Use it only on repositories you trust, avoid running it on directories containing symlinks to private locations, choose a dedicated output folder, and manually review generated function and technical-description text before submitting any filing. Treat identity documents, application forms, addresses, and uploaded materials as sensitive, and do not allow browser upload or submission without explicit review at each step.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/generate_code_doc.py:98
Finding: Source tree scanners follow symbolic links outside the authorized project directory
Content: View full analysis
Remediation: View remediation
bool: candidate = os.path.realpath(path) try: return os.path.commonpath([source_root, candidate]) == source_root except ValueError: return False ``` 3. Perform containment validation before traversing a directory or opening a file. Do not use string `startswith()` as a path-boundary check. 4. Call `entry.is_dir(follow_symlinks=False)` and `entry.is_file(follow_symlinks=False)` where appropriate. 5. Track visited directories using canonical paths or `(st_dev, st_ino)` pairs to prevent cycles and duplicate traversal. 6. Add configurable limits for recursion depth, file count, individual file size, and total bytes read to reduce denial-of-service exposure. 7. Apply the same hardened traversal helper consistently in `find_code_files()`, `count_source_lines()`, and `detect_languages()`. 8. Add tests covering directory symlinks, file symlinks, symlink cycles, path-prefix collisions, and links targeting locations outside `source_dir`. ]]>

T08 · Insecure Dependencies

Note

Location: scripts/generate_code_doc.py:261
Finding: Dependency installation guidance uses unpinned packages without integrity verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly instructs reading local directories, cloning repositories, and generating output files, which implies file read/write capability, yet it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: an agent/runtime may grant broader filesystem access than users expect, increasing the risk of unintended access to sensitive local code or writing artifacts to unsafe locations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow includes printing, scanning, uploading, and handling identity documents and signed application forms, but it does not prominently warn that these are sensitive personal documents requiring careful handling. In practice, this can lead users to expose PII or official documents through insecure storage, over-broad agent access, or accidental uploads, especially because the skill also contemplates browser-assisted filing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code auto-fills missing '主要功能' and '技术特点' content with generic, fabricated statements when README-derived material is absent or too short. In a software copyright registration workflow, this can cause users to submit inaccurate regulatory/legal filing content that does not reflect the actual project, creating compliance, rejection, or misrepresentation risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module docstring states that the generated document meets 'Chinese software copyright authority requirements' and hard-codes related formatting expectations. This imposes a specific regional/legal context in the skill's natural-language description without indicating user choice or clarifying that the tool is jurisdiction-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.