skill测试

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 3.0.0

Overview

The skill mainly claims to be a read-only documentation evaluator, but bundled reference material gives instructions for dynamic command execution that conflicts with those safety claims.

Review this skill before installing. Use it only as a read-only skill documentation evaluator, and do not allow it to run dynamic tests, execute commands copied from SKILL.md files, use API tokens, access the network, or modify files unless you explicitly request that in a sandboxed environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

start_time = time.time()
    
    try:
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: This duplicate finding points to the same dangerous pattern: passing an entire command string into Popen(..., shell=True). Because the document teaches an evaluator to discover commands from arbitrary SKILL.md content and run them, this creates a realistic command-injection path that is more dangerous than a generic code sample in isolation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

start_time = time.time()
    
    try:
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: This duplicate finding points to the same dangerous pattern: passing an entire command string into Popen(..., shell=True). Because the document teaches an evaluator to discover commands from arbitrary SKILL.md content and run them, this creates a realistic command-injection path that is more dangerous than a generic code sample in isolation.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

- 使用其他 Skills 的典型查询
- 使用模糊或歧义表达

### 3.2 Description 质量检查清单

- [ ] 清晰描述了 Skill 的核心功能
- [ ] 列举了主要使用场景 (用 "Use when" 或 "适用于" 引导)
- [ ] 包含了关键触发词汇
- [ ] 提供了足够的上下文信息
- [ ] 没有冗余或误导性信息
- [ ] 长度适中 (推荐 100-300 词)

**示例 - 优秀的 description:**
```yaml
description: |
  企业微信文档管理技能。提供文档和智能主页的创建、读取和编辑能力。
  支持通过 docid 或文档 URL 操作企业微信文档(doc_type=3)和智能表格(doc_type=10),
  以及创建智能主页和导出其内容。
  适用场景:(1) 以 Markdown 格式导出获取文档完整内容(异步轮询)
  (2) 新建文档或智能表格 (3) 用 Markdown 格式覆写文档内容
  (4) 将本地 Markdown 文件创建为智能主页 (5) 异步导出智能主页内容为 Markdown 文件。
  当用户需要查看文档内容、创建�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

✅ **明确的工具调用**
```markdown
使用 `read` 工具读取文件:
​```bash
read /path/to/file.txt
​```
```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example invocation includes a broad trigger phrase ('帮我评估 weather skill 的质量') built around generic verbs like '评估/测评/检查', which can cause the skill to activate in routine conversations that are not specifically requesting this evaluator. In an agent routing context, overly broad triggers increase the risk of misrouting, accidental invocation, and unintended exposure of user content to the skill, even though the skill itself is documented as static-only and relatively low risk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description includes broad trigger terms such as '测评', '评估', '评测', and '检查', which are common in ordinary user requests and can cause the skill to activate outside its intended scope. In an agent environment, over-broad routing can lead to incorrect skill selection, reduced reliability, and unintended access to local skill documentation or directory structures during analysis workflows.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill content consistently mandates Chinese-language interaction and documentation framing, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively forces one language without opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: 该 Markdown 文档标题及全文内容均以中文呈现，且未说明这是区域/受众限定文档，也未提供用户可选的语言或本地化选项。根据规则，强制特定语言而无用户选择属于自然语言层面的语言/locale 策略违规。

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The documentation is written in Chinese throughout and does not indicate that users may choose another language or that the locale is intentionally limited. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file uses Chinese throughout, including the title and all instructions, but does not indicate that Chinese is optional or that the guide is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.