Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only auditing and recommendation helper, with sensitive local scans disclosed and mostly gated by explicit user action.
Before installing, be aware that this skill can help an agent read local skill/plugin directories, MCP config metadata, and, when you explicitly run the usage-signal collector, agent session transcripts. Use it only when you are comfortable auditing those local paths, avoid broad all-client scans unless needed, and review reports before following any suggested install, update, archive, or uninstall action.
Git status checks and external git subprocess execution go beyond a plain documentation/recommendation role and introduce command-execution risk, even if intended read-only. Shelling out can leak repository metadata, touch unexpected paths through repository configuration, or create a misleading safety model when the skill says it does not actively operate on the environment.
Git status checks and external git subprocess execution go beyond a plain documentation/recommendation role and introduce command-execution risk, even if intended read-only. Shelling out can leak repository metadata, touch unexpected paths through repository configuration, or create a misleading safety model when the skill says it does not actively operate on the environment.
Git status checks and external git subprocess execution go beyond a plain documentation/recommendation role and introduce command-execution risk, even if intended read-only. Shelling out can leak repository metadata, touch unexpected paths through repository configuration, or create a misleading safety model when the skill says it does not actively operate on the environment.
Git status checks and external git subprocess execution go beyond a plain documentation/recommendation role and introduce command-execution risk, even if intended read-only. Shelling out can leak repository metadata, touch unexpected paths through repository configuration, or create a misleading safety model when the skill says it does not actively operate on the environment.
Git status checks and external git subprocess execution go beyond a plain documentation/recommendation role and introduce command-execution risk, even if intended read-only. Shelling out can leak repository metadata, touch unexpected paths through repository configuration, or create a misleading safety model when the skill says it does not actively operate on the environment.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
# Codex 特有配置
codex:
skills_dir: "~/.codex/skills/"
config_file: "~/.codex/config.toml"
# Codex 当前技能生态较新，外部信号可能不丰富，建议降低 Community 阈值
community_min_stars: 5 # 默认100→降低到5（生态新）
The document instructs scanning local agent configuration files in user home directories, which can expose sensitive configuration details such as MCP server endpoints, commands, and environment variables if implemented without strict read-only scope and masking. Although the skill states env fields must be desensitized and the intent is audit-only, enumerating and parsing these files still increases the chance of credential leakage or overbroad local file access by downstream agents.
~/.zcode/cli/config.json # ZCode MCP
~/.claude.json # Claude Code MCP
~/.codex/config.toml # Codex MCP
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- id: "SEC-004"
type: "supply_chain"
severity: "HIGH"
description: "curl | bash 远程脚本直接执行 — 需附带 SHA256 校验和"
scope:
files: ["README.md", "*.md"]
patterns:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- name: "summarize"
version: "6.8.0"
category: docs
tags: ["summary", "session", "context", "token-tracking", "error-harvest", "self-evolve", "compress", "cross-agent"]
description: "总结 → 错误收割·自进化·可逆压缩 | Summarize → error harvest·self-evolve·compress"
source: "local"
homepage: "https://github.com/gtbwpkwjnb-alt/summarize-skill"
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- name: "summarize"
version: "6.8.0"
category: docs
tags: ["summary", "session", "context", "token-tracking", "error-harvest", "self-evolve", "compress", "cross-agent"]
description: "总结 → 错误收割·自进化·可逆压缩 | Summarize → error harvest·self-evolve·compress"
source: "local"
homepage: "https://github.com/gtbwpkwjnb-alt/summarize-skill"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# 分层测试 — T1/T2/T3 + T3 活性验证
> 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# 分层测试 — T1/T2/T3 + T3 活性验证
> 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# 分层测试 — T1/T2/T3 + T3 活性验证
> 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# 分层测试 — T1/T2/T3 + T3 活性验证
> 验证 ④ 三级分层 + ④-a T3 活性验证逻辑
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
"--zcode-config", str(local_tree / "missing-config.json"),
"--agents-dir", str(local_tree / "missing-agents"),
"--reasonix-dir", str(local_tree / "missing-reasonix"), "--json"]
first = subprocess.run(args + ["--output", str(output)], capture_output=True, text=True, encoding="utf-8")
assert first.returncode == 0, first.stderr
initial = json.loads(output.read_text(encoding="utf-8"))
assert initial["scope"] == "ecosystem"
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
initial = json.loads(output.read_text(encoding="utf-8"))
assert initial["scope"] == "ecosystem"
assert initial["scan"]["mode"] == "full"
second = subprocess.run(args + ["--baseline", str(output)], capture_output=True, text=True, encoding="utf-8")
assert second.returncode == 0, second.stderr
reused = json.loads(second.stdout)
assert reused["scan"]["mode"] == "incremental"
The code explicitly requires Chinese characters in the UI short description and checks for multiple Chinese-language content requirements in SKILL.md. This is a natural-language policy violation because it hard-enforces a specific language/locale rather than offering user choice or documenting a justified locale restriction.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## [8.2.2] - 2026-07-23
- config.yaml 顶部注明本文件为 Agent 行为约定配置、无脚本消费，并在 translation_refinement 块补 collect 脚本声明，三个脚本均有 script 声明。
- platforms/workbuddy.yaml 移除与只读底线矛盾的 write 权限；新增 platforms/README.md 说明平台文件仅记录平台特征、无脚本消费。
- 推荐档位术语统一为六档（保留/升级/替换/引入/共存/归档），修正 SKILL.md、config.yaml 注释与 recommendation-framework.md 中的"五档"误述。
- 合并 references/description-refinement.md 的 Forma 维度/权重/阈值至 description-quality.md 并删除原文件，消除双份事实源。
- SKILL.md 输出节与 report-template.md 接入 references/output-contract.md 事实状态契约引用。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## [8.2.2] - 2026-07-23
- config.yaml 顶部注明本文件为 Agent 行为约定配置、无脚本消费,并在 translation_refinement 块补 collect 脚本声明,三个脚本均有 script 声明。
- platforms/workbuddy.yaml 移除与只读底线矛盾的 write 权限;新增 platforms/README.md 说明平台文件仅记录平台特征、无脚本消费。
- 推荐档位术语统一为六档(保留/升级/替换/引入/共存/归档),修正 SKILL.md、config.yaml 注释与 recommendation-framework.md 中的"五档"误述。
- 合并 references/description-refinement.md 的 Forma 维度/权重/阈值至 description-quality.md 并删除原文件,消除双份事实源。
- SKILL.md 输出节与 report-template.md 接入 references/output-contract.md 事实状态契约引用。
L03 describes the skill as being for Chinese users ('面向中文用户') and the outputs are defined in Chinese, but the file does not offer an alternative language mode or user opt-in. Under the policy, forcing a specific language without choice is a natural-language policy violation unless clearly justified as region-specific.
L21 states '支持自然语言请求' without defining constraints, examples of valid phrasing, or exclusion conditions. This can make activation ambiguous and increases the chance of unintended invocation from ordinary conversation rather than explicit skill commands.
The skill references scripts, file inspection, hashing, optional network-backed market research, and shell-style commands, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host may grant broader file, network, or shell access than users expect from a 'default read-only' auditing skill, increasing the risk of overreach or accidental sensitive data access.
The description states '面向中文用户' and the skill behavior is oriented toward Chinese output by default, which is a natural-language locale policy constraint. The file does not offer an explicit language choice or opt-in, so it appears to force a specific language/locale.
The instruction '默认简体中文' sets a mandatory default locale for generated content. Because no nearby text offers the user a language selection or opt-in, this is a policy-relevant language constraint.
Both the short description and default prompt specify Chinese output ('中文说明精炼' and Chinese-only instructions) with no indication that the user may choose another language. This is a natural-language locale policy concern because it imposes a language preference by default rather than offering an explicit opt-in or selection.
Detected: suspicious.dynamic_code_execution