Security audit

分析代码

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only code analysis skill with clear scope limits and no evidence of hidden execution, mutation, persistence, or data exfiltration.

Before installing, be aware that this skill may run implicitly for code-analysis prompts and will inspect repository code to answer the request. Use explicit wording if you want to avoid broader standard-mode cross-service searches.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation without defining any trigger constraints, exclusions, or confirmation requirements. Because this skill analyzes user-specified code and repository content, automatic invocation can expose repository structure or code context unexpectedly and may cause the agent to act on ambiguous prompts without clear user intent.

Static analysis

No suspicious patterns detected.