Security audit

Windows Disk Cleaner

Security checks for vulnerabilities and agentic risk

Overview

This Windows cleanup skill is mostly purpose-aligned, but it labels and preselects cleanup commands that can delete important Firefox profile data and Docker volumes.

Review this skill carefully before installing. Do not run its generated cleanup commands as-is, especially Firefox and Docker entries; inspect every command, remove Docker `--volumes`, and avoid any command targeting Firefox profile roots. Treat generated reports as sensitive because they contain local usernames, paths, and file inventories.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scan_disk.txt:343
Finding: Firefox Profile Data Is Incorrectly Classified as Safe to Delete
Content: View full analysis
{ cb.checked = true; }); updateSelection(); } // Initial selection of all safe items selectAllSafe(); ``` ### Technical Analysis The scanner treats the entire Firefox `Profiles` directory as a browser cache. The generated cleanup command recursively deletes every child of that directory. A Firefox profile is not merely a cache directory. Depending on Firefox configuration, it can contain bookm ...[truncated 1697 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scan_disk.txt:286
Finding: Docker Persistent Volumes Are Included in Preselected Safe Cleanup
Content: View full analysis
$null $result.categories.safe += @{ name = "Docker 未使用资源" paths = @("docker system") size_bytes = -1 size_display = "运行 docker system df 查看详情" clean_command = "docker system prune -af --volumes" description = "悬空镜像、停止的容器、未使用网络和卷。注意：--volumes 会删除未使用的卷" } Write-Host " Docker: 已检测到，运行 'docker system df' 查看详情" } catch { } } ``` The report automatically selects this entry because it is classified as safe: ```javascript function selectAllSafe() { document.querySelectorAll('#safe-list input[type=checkbox]').forEach(cb => { cb.checked = true; }); updateSelection(); } ``` ### Technical Analysis The command uses both `-a` and `--volumes`: ```text docker system prune -af --volumes ``` The `--volumes` option permits Docker to remove unused volumes. Docker volumes commonly contain persistent databases, uploads, application state, development environments, and other non-reconstructable data. A volume being unused or not currently attached does not mean that its contents are disposable. The implementation conflicts with `references/safe_paths.md`, which places Docker volumes in the user-confirmation category. Nevertheless, the script places the command in `categories.safe`, and the report preselects all safe entries. The scanner invokes `docker system df` but does not use its output to enumerate or explain the affected volumes. The user therefore receives no per-volume inventory before being offered a broad destructive command. ### Attack Path 1. A Docker installation contains a stopped project with ...[truncated 1157 chars]
Remediation: View remediation
" ``` 7. Recommend a backup or snapshot before volume removal. 8. Detect shared or remote Docker contexts and warn that cleanup may affect resources outside the user's local project. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_report.py:291
Finding: Unescaped Scan Data Enables Script and HTML Injection in Generated Reports
Content: View full analysis
{name} {desc} {size_display} """ def make_large_files_section(files): if not files: return "" rows = "" for f in files: rows += f""" {f.get('name','')} {f.get('path','')} {f.get('size_display', format_size(f.get('size_bytes',0)))} {f.get('last_modified','')} """ ``` The complete item collection is also inserted directly into an executable script context: ```python # Prepare JSON data for the frontend items_json = json.dumps(safe_items + review_items, ensure_ascii=False) html = HTML_TEMPLATE.format( # ... items_json=items_json, ) ``` ```html
Remediation: View remediation
` block. 5. Store JSON in a non-executable element and escape characters significant to the HTML parser: ```html ``` Then parse its text content in JavaScript. 6. At minimum, encode `<`, `>`, `&`, U+2028, and U+2029 in JSON embedded in HTML. 7. Validate the input against a strict schema, including expected field types, value ranges, and an allowlist of supported cleanup command templates. 8. Do not accept arbitrary cleanup commands from input JSON. Generate commands internally from validated item identifiers and canonical paths. 9. Add a restrictive Content Security Policy that blocks inline and external scripts except for a trusted nonce-bearing script. 10. Add tests containing hostile values such as HTML tags, encoded entities, quotes, ampersands, and `` in every imported field. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes reading scan scripts and generating output files, but it does not declare any explicit tool scope or permissions. In an agent environment, undeclared file read/write capability weakens policy enforcement and can allow broader filesystem access than reviewers or users expect, which is especially sensitive for a disk-cleaning skill that inspects many user directories and produces artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and user-facing interface text are entirely in Chinese, including the stated usage and generated report content, with no indication that language is configurable or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language locale policy concern because the skill implicitly enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script collects and persists user-identifying and sensitive local-environment data, including the username, drive usage, installed tooling, and detailed filesystem paths for caches, downloads, large files, and project directories. In the stated skill context, the JSON is explicitly meant to be handed to an AI assistant, which increases privacy risk because local path structures and filenames can reveal personal, corporate, or secret-bearing information without a prominent consent or redaction step.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 标题和全文内容均以中文呈现，但文档中没有说明这是面向特定中文用户群体的区域性限制，也没有提供用户可选择其他语言的说明。根据语言/locale 政策，强制单一语言且无用户 opt-in 可构成自然语言层面的政策问题。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script writes the scan results to disk automatically and only discloses this at the end, after the file has already been created. While this is not destructive, it creates a privacy and data-handling issue because a report containing system details and file inventory may remain on disk in an accessible location without clear up-front notice or confirmation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.