AI Agent Security Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent security scanner, but its default AI mode can send sensitive scan findings and source snippets to an external AI endpoint without redaction or confirmation.

Review this skill carefully before installing. Use --no-ai for sensitive or proprietary repositories unless you explicitly want findings sent to an AI provider. If AI analysis is used, assume matched source snippets, possible secrets, local paths, and the configured API credential may be sent to the selected base URL; avoid custom base URLs unless you trust and control the endpoint.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/audit.py:163

Finding

Sensitive Scan Findings Are Transmitted to an External AI Service Without Redaction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/audit.py:160

Finding

Unrestricted AI Base URL Can Receive the API Key and Sensitive Findings

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/audit.py:163

Finding

Untrusted Repository Content Is Embedded in the AI Instruction Prompt

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/audit.py:147

Finding

AI Mode Relies on an Undeclared and Unpinned Runtime Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/audit.py (reported line 43)May include surrounding context.

python

"Unsafe Pickle Load": re.compile(r'pickle\.loads?\s*\('),
    "Unsafe YAML Load": re.compile(r'yaml\.load\s*\(.*Loader=.*FullLoader'),
    "Hardcoded Admin Credentials": re.compile(r'(?i)(admin|root)\s*[=:]\s*["\']?(admin|password|123456)["\']?'),
    "Insecure File Permissions - chmod 777": re.compile(r'chmod\s+777|os\.chmod\s*\(.*0o?777'),
    "Debug Mode Enabled": re.compile(r'(?i)debug\s*=\s*True'),
    "CORS Wildcard": re.compile(r'(?i)Access-Control-Allow-Origin.*\*'),
    "Insecure HTTPS Disable": re.compile(r'(?i)(verify\s*=\s*False|ssl_verify.*false|disable_ssl)'),

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 75% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/audit.py (reported line 44)May include surrounding context.

python

"Unsafe YAML Load": re.compile(r'yaml\.load\s*\(.*Loader=.*FullLoader'),
    "Hardcoded Admin Credentials": re.compile(r'(?i)(admin|root)\s*[=:]\s*["\']?(admin|password|123456)["\']?'),
    "Insecure File Permissions - chmod 777": re.compile(r'chmod\s+777|os\.chmod\s*\(.*0o?777'),
    "Debug Mode Enabled": re.compile(r'(?i)debug\s*=\s*True'),
    "CORS Wildcard": re.compile(r'(?i)Access-Control-Allow-Origin.*\*'),
    "Insecure HTTPS Disable": re.compile(r'(?i)(verify\s*=\s*False|ssl_verify.*false|disable_ssl)'),
    "Weak Hash - MD5": re.compile(r'(?i)hashlib\.md5\('),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 52)May include surrounding context.

python

}

# 需要扫描的文件扩展名
SCAN_EXTENSIONS = {'.py', '.js', '.ts', '.jsx', '.tsx', '.json', '.yaml', '.yml', '.env', '.txt', '.md', '.sh', '.bat', '.ps1', '.java', '.go', '.rs'}

# 跳过的目录
SKIP_DIRS = {'node_modules', '.git', '__pycache__', '.venv', 'venv', 'dist', 'build', '.next', '.nuxt'}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises and requires capabilities equivalent to environment access, filesystem reads/writes, and shell execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity: a reviewer or runtime may not have a clear, least-privilege contract for what the skill is allowed to do, increasing the chance of overbroad execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description and top-level documentation are written entirely in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/audit.py (reported line 43)May include surrounding context.

python

"Unsafe Pickle Load": re.compile(r'pickle\.loads?\s*\('),
    "Unsafe YAML Load": re.compile(r'yaml\.load\s*\(.*Loader=.*FullLoader'),
    "Hardcoded Admin Credentials": re.compile(r'(?i)(admin|root)\s*[=:]\s*["\']?(admin|password|123456)["\']?'),
    "Insecure File Permissions - chmod 777": re.compile(r'chmod\s+777|os\.chmod\s*\(.*0o?777'),
    "Debug Mode Enabled": re.compile(r'(?i)debug\s*=\s*True'),
    "CORS Wildcard": re.compile(r'(?i)Access-Control-Allow-Origin.*\*'),
    "Insecure HTTPS Disable": re.compile(r'(?i)(verify\s*=\s*False|ssl_verify.*false|disable_ssl)'),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool is marketed as a local security scanner, but it transmits scan findings derived from user code to an external AI service for analysis. Those findings can include snippets of source code, secrets, tokens, passwords, connection strings, or other sensitive material, creating a real data-exfiltration and confidentiality risk in a security-audit context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Reading API credentials from environment variables and allowing outbound requests to a configurable base URL expands the tool's capability beyond basic local scanning. In this skill context, that broader capability increases the chance that sensitive findings are sent to unintended or attacker-controlled endpoints if the base URL is misconfigured or influenced by the environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The hardcoded default external endpoint https://api.deepseek.com/v1 confirms that the tool performs outbound transmission to a third-party service. In a code-auditing tool that may process secrets and proprietary source code, external transmission is materially sensitive even if TLS is used.

Content

Scanner excerpt · scripts/audit.py (reported line 150)May include surrounding context.

python

return None
    
    if not base_url:
        base_url = os.environ.get('DEEPSEEK_BASE_URL', 'https://api.deepseek.com/v1')
    
    client = OpenAI(api_key=api_key, base_url=base_url)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sends issue data to the external API at the call site without a just-in-time warning or confirmation, even though the transmitted payload may contain sensitive security findings and code context. For a security audit tool, silent upload of findings undermines user expectations of confidentiality and increases accidental disclosure risk.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/audit.py (reported line 257)May include surrounding context.

python

lines.append("")
    
    lines.append("=" * 60)
    lines.append("  报告生成时间: " + __import__('datetime').datetime.now().strftime('%Y-%m-%d %H:%M:%S'))
    lines.append("  工具: Agent Security Audit v1.0")
    lines.append("=" * 60)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This manifest includes a natural-language field value in Chinese for the author name, which may create an implicit language/locale inconsistency without any documented choice or justification. Under the locale policy rule, natural-language metadata that forces or assumes a specific language can be a policy concern when no opt-in or explanation is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prompt explicitly says 请用中文回复, which forces a specific output language regardless of user preference. This is a natural-language locale policy issue because the file does not offer a language choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.