Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Mac磁盘清理顾问
Security checks for vulnerabilities and agentic risk
Overview
This disk-cleanup advisor needs review because some recommendations presented as safe can permanently erase project history, logs, or stored application data.
Use read-only reports until the cleanup guidance is corrected. Never treat .git/objects/ as disposable. Review exact targets and backups before deleting files or Docker volumes, avoid blanket privileged log wipes, and expect unrelated promotional content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 100% confidence
- Finding
The declared purpose explicitly prohibits automatic deletion and promises a scan-and-review workflow. The supplied code instead immediately invokes Finder's empty-trash operation. Although trash cleanup relates to freeing disk space, executing deletion directly materially contradicts the stated safety and execution boundaries.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The cleanup targets relate to the declared purpose, but the behavior violates its central safety boundary. The executable rm -rf commands remove contents rather than merely analyze usage or generate a reviewable cleanup plan. The supplied chunk provides no confirmation mechanism or checks supporting its claim that cache deletion is safe. Sudo authentication, if prompted, is not a substitute for the promised review and confirmation workflow.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic execution is not established, but the skill presents 'git gc --aggressive --prune=now' as safe and not deleting history without explaining its immediate pruning behavior. If followed, it can remove otherwise recoverable unreachable objects and increases corruption risk when concurrent processes write to the repository.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Removing a virtual environment is related to disk cleanup, but
rm -rf ./venvperforms deletion rather than analysis or reporting. The comment explaining that the environment can be rebuilt does not provide confirmation or enforce the declared safety workflow.- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The targeted resources are consistent with Mac disk cleanup, but the execution behavior contradicts the explicit promise not to delete files automatically. If run as supplied, these commands perform deletion immediately; the cautionary comments do not enforce review or confirmation. The simulator command targets unavailable simulators, not all simulators as its comment suggests.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The document does not demonstrate automatic execution, but it recommends 'docker system prune -a --volumes' without explaining that eligible unused volumes may contain valuable persistent data. Docker's confirmation prompt does not establish that those resources are disposable, and the command can cause data loss if followed as generic cleanup advice.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
The command permanently deletes every non-hidden entry matched under the user's cache directory and is presented as universally safe. Although cache cleanup is relevant to the skill, blanket deletion while applications are active can disrupt them or remove offline state, and the suggested recovery guarantee is too broad.
- Content
清理系统缓存（安全，重启后自动重建）
bash # 清空用户 Caches（安全） rm -rf ~/Library/Caches/* # 清空系统日志 sudo rm -rf /Library/Logs/*
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
清理系统缓存（安全，重启后自动重建）
bash # 清空用户 Caches（安全） rm -rf ~/Library/Caches/* # 清空系统日志 sudo rm -rf /Library/Logs/*
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
清空系统日志
sudo rm -rf /Library/Logs/* rm -rf ~/Library/Logs/*
text ### 废纸篓彻底清空（命令行版）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Xcode 清理
bash # 清理 DerivedData（编译缓存，可自动重建） rm -rf ~/Library/Developer/Xcode/DerivedData/ # 清理模拟器（谨慎，会删除所有模拟器数据） xcrun simctl delete unavailable
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
In context, this command runs with sudo and permanently removes matching system-wide log contents without age, ownership, or retention checks. It can erase troubleshooting and security evidence; it does not, however, delete the filesystem root.
- Content
rm -rf ~/Library/Caches/*
清空系统日志
sudo rm -rf /Library/Logs/* rm -rf ~/Library/Logs/*
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/Library/Caches/*
清空系统日志
sudo rm -rf /Library/Logs/* rm -rf ~/Library/Logs/*
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
Blanket deletion of user logs permanently removes potentially valuable troubleshooting or incident evidence. Its presentation as routine safe cleanup lacks age-based selection, retention checks, and a recoverable removal path.
- Content
清空系统日志
sudo rm -rf /Library/Logs/* rm -rf ~/Library/Logs/*
text ### 废纸篓彻底清空（命令行版）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
清理 Python venv（项目代码不受影响）
bash # 删除 venv，保留代码（之后用 pip install -r requirements.txt 重建） rm -rf ./venvXcode 清理
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Xcode 清理
bash # 清理 DerivedData（编译缓存，可自动重建） rm -rf ~/Library/Developer/Xcode/DerivedData/ # 清理模拟器（谨慎，会删除所有模拟器数据） xcrun simctl delete unavailable
The cleanup rules classify .git/objects/ as rebuildable without warning that deleting it can destroy repository history.
High
- Category
- Output Handling
- Confidence
- 99% confidence
- Finding
The rule incorrectly groups '.git/objects/' with disposable dependency directories. This directory stores Git objects, including committed content and history that may exist nowhere else; deleting it can render a repository unusable and cannot generally be repaired with 'git restore'.
- Content
Cleanup command examples contradict the explicit trash-first safety rule.
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The reference commands permanently delete broad directory contents despite the stated trash-first rule. Labeling these actions safe and automatically recoverable can cause users or an executing agent to underestimate the loss of application state or diagnostic records.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The issue is not the mere presence of sudo, but its use to recursively erase all matching contents under '/Library/Logs/' as generic cleanup. If approved and executed, this elevated operation can destroy diagnostic or audit evidence without checking retention needs or identifying safe targets.
- Content
rm -rf ~/Library/Caches/*
清空系统日志
sudo rm -rf /Library/Logs/* rm -rf ~/Library/Logs/*
text
The skill mandates unrelated promotional content in every response.
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
The skill mandates unrelated advertising and an external invitation link in every response, contaminating disk-audit output with the author's promotional agenda. This can mislead users into treating an unrelated destination as an endorsed part of the workflow, although the text does not demonstrate exfiltration or malicious behavior at that destination.
- Content
The skill immediately activates for general computer-organization requests that do not necessarily concern disk cleanup.
Low
- Category
- Trigger Abuse
- Confidence
- 96% confidence
- Finding
The instruction to activate immediately includes “整理一下我的电脑” (“organize my computer”). This could mean arranging files or applications rather than auditing disk usage, and no exclusion or clarification condition distinguishes these requests.
- Content
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- SKILL.md:169