Security audit

trouble-shooting

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate troubleshooting helper, but it can mutate and clean up Git repository state with broad activation wording and limited built-in safeguards.

Install only if you are comfortable with a skill creating temporary Git branches and worktree directories, merging troubleshooting changes, and force-removing the isolated worktree and branch. Commit or back up important work first, prefer explicit command invocation over broad trigger phrases, and review the .trouble-shooting records if project paths or issue titles are sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes creating worktrees/subagents and applying or discarding code changes, which implies filesystem access and likely shell execution, but it declares no corresponding permissions or safety boundaries. This is dangerous because the agent may gain effective code-execution and file-modification capability without explicit user awareness, increasing the chance of unintended repository changes or abuse through hidden operational scope.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger phrases include very common expressions like “报错了”, “有问题”, and “排查”, which are likely to appear in normal conversation even when the user did not intend to invoke this skill. That makes accidental activation plausible, potentially causing the agent to start isolation workflows, create worktrees, or shift execution context unexpectedly.

Vague Triggers

High

Confidence: 95% confidence
Finding: The usage section says the skill can start when the user says generic phrases or directly invokes the command, but it does not define clear scope boundaries for when troubleshooting isolation should or should not occur. This ambiguity can cause the agent to overreach into context switching and code-modification workflows during ordinary debugging discussion, increasing operational risk and user confusion.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The apply flow performs forced cleanup of the worktree and deletion of the troubleshooting branch immediately after merge, without confirmation, backup, or strong validation of the target paths and branch names. In an agent skill that automates troubleshooting isolation, mistakes or tampered session metadata could permanently remove in-progress work or destroy repository state with little user awareness.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The discard path permanently removes the worktree and deletes the temporary branch without any warning, confirmation, or archival of the changes themselves. In this skill context, the script is explicitly designed to isolate troubleshooting work; automatically destroying that isolated state can lead to irreversible loss of debugging artifacts or fixes, especially if the active session file is stale or manipulated.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script writes a snapshot file containing branch, timestamp, title, and current working directory without any user-facing notice or consent. In an agent skill context, silent persistence of execution context can expose sensitive workspace metadata and creates a privacy and transparency problem, especially because the skill description emphasizes automatic context isolation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill creates a git worktree as a side effect without any prior user-facing disclosure. In an agent environment, silently creating branches and filesystem directories can alter repository state and leak sensitive code into additional locations, increasing operational and privacy risk.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The comment explicitly states that the main-line context should be saved automatically without informing the user. That indicates intentional concealment of persistence behavior, which is particularly risky in an agent skill because users may not realize their workspace context is being recorded and reused.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The comment suggests preserving all current context automatically, which can include sensitive environmental or repository metadata, without user disclosure or consent. In the context of a troubleshooting skill, that broad automatic capture is more dangerous because users may invoke it during incidents involving secrets, proprietary code, or production paths.

Static analysis

No suspicious patterns detected.