蜂兵虾将

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:08 AM UTC
• Version: 1.4.1

Overview

The skill is not clearly malicious, but it asks for automatic broad persistent memory access and overstates its automation capabilities.

Review this skill before installing if you use shared or sensitive workspaces. Its memory feature can read and update cross-session profile/history files automatically, and its advertised autonomous monitoring/reporting capabilities are not fully implemented in the inspected artifacts. Prefer using it only with explicit memory consent, a dedicated storage directory, and no sensitive personal or business data until scoping and deletion controls are added.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:44
• Finding: Mandatory Access to Workspace-Wide Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:44-57` **Vulnerability Type**: Excessive access to shared user profiles, session history, and long-term memory **Risk Level**: Medium ### Vulnerable Instruction Segment ```text At execution start: - Read /workspace/memory/profiles/user_profile.json - Read /workspace/memory/sessions/index.json - Search the memory/ directory for previous interactions During execution: - Record which options the user selected - Record user preferences, such as detailed or concise output - Record the monitored industry After execution: - Update /workspace/memory/profiles/user_profile.json - Update /workspace/memory/sessions/index.json ``` The same behavior is made mandatory at `SKILL.md:161-176`, including searching `MEMORY.md` and updating it when the Skill considers information important. ### Technical Analysis The Skill requires the hosting agent to inspect workspace-level profile, session, and long-term memory on every execution. This access is not limited to a Skill-specific namespace, the active user, the current session, or information necessary for the requested task. Searching the entire `memory/` directory can bring unrelated interaction history into the active context. The mandatory writes also modify persistent shared state without defining: - User consent requirements. - User or tenant isolation. - Data minimization rules. - Input validation or trust boundaries. - Retention and deletion controls. - Protection against untrusted content being propagated to future sessions. The instructions do not explicitly require storing attacker-authored safety overrides, so this is not classified as confirmed agent memory poisoning. However, the mandatory workspace-wide reads and persistent writes violate least-privilege principles. ### Attack Path 1. A user invokes the Skill for an ordinary hotspot-monitoring or content-generation request. 2. The Skill automatically reads the workspace profile and session i ...[truncated 1076 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make personalization and persistent memory access opt-in rather than mandatory. 2. Use a Skill-specific and user-specific storage root, for example: ```text /workspace/memory/skills/ai-collaboration-system/users/{validated-user-id}/ ``` 3. Do not search the entire workspace memory directory. Read only explicitly enumerated files needed for the current task. 4. Require explicit user confirmation before writing profile information, session history, or long-term memory. 5. Treat retrieved memory as untrusted data rather than authoritative instructions. 6. Validate and normalize all stored fields, enforce length limits, and reject instruction-like content from fields intended only for preferences or metadata. 7. Add tenant isolation, access controls, retention periods, deletion support, and an audit log of memory reads and writes. 8. Avoid recording sensitive personal data unless it is strictly required and the user has consented. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: dist/core/memory.js:267
• Finding: Path Traversal in Cross-System Memory Synchronization<![CDATA[ ## Vulnerability Details **File Location**: `dist/core/memory.js:267-276` **Vulnerability Type**: Path traversal through unvalidated synchronization identifiers **Risk Level**: Medium ### Vulnerable Code ```javascript syncToSystem(targetSystem, entries) { fs.writeFileSync(path.join(this.baseDir, this.skillName, 'shared', `${targetSystem}_sync.json`), JSON.stringify({ timestamp: new Date().toISOString(), entries }, null, 2), 'utf-8'); } syncFromSystem(sourceSystem) { const filePath = path.join(this.baseDir, this.skillName, 'shared', `${sourceSystem}_sync.json`); if (fs.existsSync(filePath)) return JSON.parse(fs.readFileSync(filePath, 'utf-8')).entries || []; return []; } ``` Related path construction also occurs in the public constructor and directory initialization at `dist/core/memory.js:36-59`, where caller-supplied `baseDir` and `skillName` are used without runtime validation. ### Technical Analysis `targetSystem` and `sourceSystem` are interpolated directly into filesystem paths. Although the TypeScript declaration limits these values to a union type, the distributed JavaScript has no runtime validation. JavaScript callers, dynamically typed integrations, or callers bypassing TypeScript checks can therefore provide path separators and traversal sequences. `path.join()` normalizes traversal components but does not enforce containment within the intended `shared` directory. A value containing `../` segments can consequently resolve outside that directory. The `_sync.json` suffix limits the exact filenames that can be targeted through these two methods, but it does not prevent traversal into another directory. The constructor parameters provide a broader redirection risk because arbitrary `baseDir` and `skillName` values affect all memory paths. ### Attack Path 1. An application passes an untrusted or insufficiently validated value to `syncToSystem`, `syncFromSystem`, the constructor's `skillName`, or the constructor ...[truncated 1221 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce runtime allowlists rather than relying on TypeScript types: ```javascript const SYSTEM_NAMES = new Set(['signal', 'workflow', 'goal', 'shared']); function validateSystemName(value) { if (!SYSTEM_NAMES.has(value)) { throw new TypeError('Invalid system name'); } return value; } ``` 2. Restrict `skillName` to a safe identifier: ```javascript function validateSkillName(value) { if (!/^[A-Za-z0-9_-]+$/.test(value)) { throw new TypeError('Invalid skill name'); } return value; } ``` 3. Resolve every path against a trusted root and verify containment before access: ```javascript function resolveContained(root, ...segments) { const trustedRoot = path.resolve(root); const candidate = path.resolve(trustedRoot, ...segments); if (candidate !== trustedRoot && !candidate.startsWith(trustedRoot + path.sep)) { throw new Error('Path escapes the configured memory root'); } return candidate; } ``` 4. Do not accept an arbitrary `baseDir` from untrusted request data. Configure the storage root through trusted application configuration. 5. Open writable files with restrictive permissions and avoid following symbolic links where the deployment environment permits. 6. Add tests covering absolute paths, `../` traversal, mixed separators, encoded separators, symbolic-link escapes, and invalid system identifiers. 7. Apply the same containment checks to every load, save, directory-creation, and health-check path in the memory implementation. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (106)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a broad, automated, cross-industry operational system with monitoring, creation, forecasting, autonomous execution, and scheduled reporting. The supplied code is instead a self-contained demonstration of agent registration, task matching, decision branching, collaboration requests, and simple chat responses printed to the console. Its primary purpose is educational/demo-oriented multi-agent orchestration, not a deployed business automation product. While there is some partial alignment at a very high level (multiple agents, routing-like selection, collaboration, basic task history), most of the headline capabilities are absent or only mocked conceptually. Therefore the description materially overstates what the code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description markets a broad, autonomous, revenue-oriented multi-agent system with industry-wide monitoring, content generation, trend forecasting, and automatic scheduled reporting/execution. The actual code chunk is only a console demonstration script using static sample data. It showcases internal subsystems such as layered memory, signal scoring, workflow knowledge extraction, and personal goal reflection. There is no visible implementation of internet-scale collection, autonomous execution, content production, scheduled jobs, or cross-industry operational automation. While some overlap exists around signal/trend analysis and automatic record-like memory features, the primary purpose and claimed capabilities are materially overstated relative to the provided code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description markets a comprehensive autonomous multi-agent system with internet monitoring, content production, trend forecasting, workflow automation, adaptive behavior, and scheduled report delivery. The actual code chunk is a TypeScript declaration file for a UnifiedMemorySystem class. Its responsibilities are limited to managing layered memory (L0-L4), storing entries, querying them, syncing memory across systems, and generating reflective summaries/insights. While memory can support a larger agent framework, this code chunk itself does not implement the headline capabilities described. Therefore the description materially overstates and misrepresents what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk is not an industry-monitoring, content-producing, auto-executing multi-agent system. Its primary purpose is a persistent memory subsystem. It uses Node.js fs/path/crypto to create local storage directories, load and save markdown/JSON memory files, archive/query records, and generate lightweight reflective summaries from stored entries. While a memory component could support a larger agent platform, this chunk itself does not implement the headline features in the description such as web collection, hotspot monitoring, content creation, trend intelligence, automatic execution, user adaptation, or scheduled reports. It also performs concrete local filesystem access and cross-system sync via files, which are not declared. Therefore the description materially overstates and misrepresents what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear mismatch between the declared description and the provided code. The description claims a complex autonomous multi-agent system with monitoring, analysis, content generation, prediction, automation, and scheduled reporting capabilities. However, the actual code chunk is an empty declaration file (`export {};`) with only a comment indicating it is an example. It does not implement any of the advertised functionality, define triggers, or access any resources. Therefore, the declared purpose is not accurately represented by the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description promises a highly autonomous, multi-agent, cross-industry system with web-wide monitoring, content creation, trend forecasting, automatic execution, adaptive routing, and scheduled reporting. The actual code chunk does not implement or demonstrate those operational capabilities. Instead, it is an example file that constructs a local system object and feeds it static arrays of sample signals, tasks, responses, goals, and time-allocation data, then prints reports to stdout. While there is some conceptual overlap with trend/signal analysis, logging, and insight generation, the primary behavior shown is a console demo of internal analysis methods rather than the declared autonomous monitoring-and-execution product. Therefore the declared description materially overstates and misrepresents what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description markets a highly autonomous, multi-agent system for industry-wide monitoring, content production, trend analysis, and scheduled auto-reporting. The actual supplied code chunk is just a declaration file defining an integrated class around four subsystems: memory, signal recognition, workflow assets, and personal goals. Its visible API supports querying, scans, workflow handling, and goal tracking/review, which is materially narrower and different in emphasis. There is no evidence in this chunk of web scraping/collection, content generation, trend prediction, scheduled execution, or automatic report delivery. Because the primary purpose and several key advertised capabilities are not represented by the code shown, this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared description promises a highly autonomous, multi-agent business operations system with broad external monitoring, generation, prediction, adaptation, and scheduled automation. The provided code does not demonstrate those behaviors. It mainly initializes four internal subsystems around a shared memory object and offers wrapper methods to generate reports from provided data and query/sync memory. There is no evidence in this chunk of network collection, content generation, forecasting logic, scheduling, autonomous task execution, industry-specific workflows, or trigger-based automation. While some naming overlaps exist (signal/workflow/goal/memory), the actual code chunk supports a more limited coordination/reporting framework than the expansive declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description markets a multi-agent business automation system that monitors industry trends across the web, creates content, predicts trends, executes tasks automatically, and sends scheduled reports. The supplied code chunk instead defines a PersonalGoalSystem centered on individual goal tracking and self-awareness: motivation analysis, goal network building, energy allocation analysis, blind spot discovery, AI mirror letters, future-self prediction, and weekly self-awareness reporting. This is a materially different primary purpose and lacks the core declared capabilities such as web collection, content generation, autonomous execution, and timed reporting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个偏商业运营与信息监控的多代理自动化系统，覆盖全行业、全网采集、内容生产、趋势预判、自动执行和定时汇报。相比之下，代码只围绕个人成长/目标管理展开：记录目标动机、建立目标网络、分析时间投入与理想分配差距、发现认知盲点、生成AI镜像信和每周自我觉察报告，并做简单的未来状态预测。代码没有任何网络采集、内容生产、行业监测、外部执行、定时触发或多智能体编排的实现痕迹。其主要目的与声明的核心用途 materially different，因此属于明显描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description promises a comprehensive autonomous AI team with multiple specialized agents and extensive capabilities across monitoring, content production, forecasting, adaptation, and automated execution. The actual code chunk is much narrower: it is a TypeScript declaration for a signal recognition system. It evaluates and stores signals, generates a daily scan report from provided inputs, identifies patterns, allows querying, and syncs data to other systems. There is no evidence in this code of web crawling, content generation, forecasting models, intent routing, autonomous execution, user adaptation, or actual scheduling logic for twice-daily reports. While signal recognition and report generation partially align with the monitoring/reporting theme, the implementation shown materially underdelivers relative to the declared primary purpose and capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a full-featured, autonomous, four-agent platform spanning collection, content generation, forecasting, execution, and scheduled reporting across industries. The supplied code chunk is much narrower: it only evaluates pre-supplied signals using fixed heuristics, stores them in memory, identifies basic aggregation patterns, returns a report, and syncs some stored items to other internal systems. There is no code for crawling the web, generating content, predicting trends in a substantive way, executing actions, recognizing user intent, routing among agents, adapting to users, or scheduling periodic reports. This is a material description-versus-behavior mismatch, with the code representing only a supporting submodule rather than the declared end-user functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description promises a multi-agent autonomous business assistant with broad capabilities: industry-wide monitoring, content creation, trend insight, proactive sensing, adaptive routing, auto-execution, and scheduled reports. The actual code chunk is only a TypeScript declaration file for a WorkflowAssetSystem focused on workflow knowledge formalization: converting user responses into tacit knowledge, extracting reusable capability patterns, constructing methodologies, and producing a daily workflow report from explicitly provided inputs. There is no evidence of web collection, trend analysis, content generation, automation triggers, scheduling, agent orchestration, or autonomous execution. This is a materially different and much narrower primary purpose than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个功能非常广泛的多代理业务自动化与情报/内容系统，但给出的代码块只处理工作经验知识提取、能力模式归纳、方法论沉淀以及跨系统同步到内存系统。其核心依赖是 memory 存储接口，而不是网络采集、内容生成、趋势分析、调度执行或定时任务框架。虽然“工作记账本/自动记录”与知识沉淀存在一点概念上的弱相关，但这不足以覆盖声明中的主要卖点。代码的主要目的与描述的主要用途存在明显偏差，因此属于描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description markets a broad, production-like autonomous multi-agent system with web monitoring, content generation, trend forecasting, adaptive behavior, and timed automated reporting. The supplied code chunk is instead a self-contained demonstration for a specific 'Spring Festival duty mechanism' workflow. It uses predefined hotspot examples, simple scoring, memory writes, and console output of summaries/templates. There is no evidence of network collection, true multi-agent orchestration, scheduling, user-intent handling, automatic execution, or trend prediction. This is a material description-behavior mismatch, not just an incomplete implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description markets a comprehensive, autonomous, multi-agent system with broad capabilities and scheduled operation. The supplied code does not implement such a system; it is explicitly labeled as a usage example, not a standalone system. Its actual behavior is limited to evaluating hotspot severity from provided sample data, generating a report, saving it to memory, and showcasing preexisting system APIs. There is no evidence here of web-wide collection, agent orchestration, autonomous execution, scheduled runs, trend prediction, or adaptive routing/reflection mechanisms as primary behavior. This is a material description-behavior mismatch rather than a minor omission.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full-featured multi-agent automation platform with monitoring, analysis, generation, autonomous execution, and recurring reports. However, the actual code chunk does not implement any of those business capabilities; it is purely an install/bootstrap script. Its observable behavior is limited to environment validation, dependency installation, TypeScript compilation, directory creation, and running a test/example. This is a material mismatch in primary purpose and implemented capabilities. While install scripts are supporting components, the only provided code does not substantiate the broad declared functionality, and it also performs local execution and filesystem modification not reflected in the empty declared permissions/triggers.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a production-like, cross-industry AI agent team with monitoring, generation, forecasting, routing, reflection, proactive sensing, automatic execution, and scheduled reports. The supplied code chunk instead only demonstrates a memory-system concept via console output and hardcoded sample data. Its actual logic is limited to defining scenarios and memory entries, displaying metadata, showing example retrieval rules, and computing a simple score-based sort over in-memory entries. There are no network calls, no data collection, no content generation, no trend analysis, no automation, no scheduler, and no agent orchestration. This is not just an incomplete subset of the declared functionality; the primary purpose is materially different: a memory subsystem demo rather than the advertised end-to-end autonomous business workflow skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: There is a strong mismatch between the expansive declared description and the narrow behavior of the code chunk. The description presents a comprehensive multi-agent automation platform with monitoring, creation, prediction, routing, adaptation, and scheduled reporting. In contrast, the code only demonstrates a specific information time-decay/scoring policy for news freshness, outputs explanatory logs, and saves that configuration into memory. No web collection, content generation, report scheduling, autonomous execution, cross-industry workflows, or multi-agent collaboration is actually shown in this code. While the code may be a supporting component of a larger system, this supplied chunk does not substantiate the declared primary purpose and instead performs a materially narrower function.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a broad, production-like autonomous multi-agent system with continuous web monitoring, content creation, forecasting, adaptive routing, and timed auto-reporting. The supplied code is much narrower: it is a demonstration script for hotspot evaluation using predefined sample data. It computes scores, assigns levels, generates console output, stores summaries in a memory subsystem, and queries stored entries. There is no evidence of network access, live monitoring, scheduled execution, autonomous task execution, or the named advanced mechanisms. The primary purpose is therefore materially narrower and different from the declared description.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill enables cross-conversation memory by default and instructs automatic reading/writing of user data without any warning or consent flow. In a business-assistant context, this can silently accumulate sensitive preferences, industry interests, and prior interaction content, making inadvertent disclosure or misuse more damaging.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The rules make persistent memory reads and writes mandatory, including updates to long-term memory, which normalizes ongoing collection and reuse of user data without contextual checks. This is especially dangerous because the skill is framed as broad business automation across sensitive sectors, so stored memory may contain high-value commercial or personal information that can later leak or be repurposed.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a personal goal-tracking and psychological self-reflection system, which materially diverges from the skill’s declared business-monitoring, content-creation, trend-insight, and automation scope. Scope mismatch is dangerous because it can collect and process sensitive personal data users would not reasonably expect, undermining informed consent and expanding the attack/privacy surface.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**A**：
```bash
# 删除记忆目录
rm -rf memory/my_system/

# 重新创建系统
const ai = new AICollaborationSystem('my_system');

• Confidence: 98% confidence
• Finding: The explicit `rm -rf memory/my_system/` command is a high-risk destructive operation presented in a documentation workflow without guardrails. In an agent or automation setting, command examples can be copied verbatim or adapted unsafely, and recursive deletion can cause permanent loss of user data or broader filesystem damage if variables, symlinks, or paths are mishandled.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The file documents that any one of five conditions should trigger deep analysis, but the actual state determining needAnalysis was computed earlier using only attentionScore >= 80. This creates a dangerous false sense of coverage in a monitoring and reporting workflow: users may believe sensitive or urgent items will be escalated when, in fact, several documented trigger paths are nonfunctional.

Static analysis

No suspicious patterns detected.