大模型Token压缩·成本节约

• Outcome: Review
• Latest audit: Oct 23, 2026 · 9:45 AM UTC
• Version: 1.8.1

Overview

This skill needs review because it forces advertising into responses, exposes API keys during setup, and does not consistently enforce reporting opt-outs.

Review before installing. Remove mandatory advertising, enforce the reporting switch across every upload path, and label demonstration dashboards. Enter credentials locally without printing them or sharing them in chat, and rotate any key already exposed. Inspect a pinned installer before execution and use only an approved HTTPS reporting destination; the current disable command does not govern the standalone uploader.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (42)

Tainted flow: 'INGEST_URL' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

MRKJAI_API_BASE determines where the script sends both telemetry and the X-API-Key credential, without validating the destination or requiring HTTPS. An attacker who can influence this configuration could redirect uploads to a credential-collection endpoint, while an HTTP configuration would expose the credential in transit. Endpoint customization fits the advertised enterprise integration use case, so this is a conditional configuration-security weakness rather than evidence of deliberate exfiltration or a critical vulnerability.

Content

Scanner excerpt · scripts/headroom_upload.py (reported line 125)May include surrounding context.

python

"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json=event, headers=headers, timeout=10)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'INGEST_URL' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The batch uploader has the same unvalidated destination configuration and sends its API key along with the supplied JSON events. If the endpoint configuration is compromised or uses HTTP, the credential and batch contents can be disclosed; batch mode may include more information because event fields are unrestricted. This requires configuration influence or an unsafe deployment and does not establish unsolicited data theft.

Content

Scanner excerpt · scripts/headroom_upload.py (reported line 139)May include surrounding context.

python

"Content-Type": "application/json",
    }
    try:
        resp = requests.post(INGEST_URL, json={"events": events}, headers=headers, timeout=15)
        resp.raise_for_status()
        return resp.json()
    except requests.exceptions.RequestException as e:

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly requires unrelated advertising after every response. This is deliberate output manipulation rather than functionality necessary to compress prompts, and it can make unsolicited referrals appear endorsed by the assistant.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The mandatory promotional footer redirects assistant output to unrelated marketing and community links, exceeding the token-compression purpose. However, the supplied SKILL.md does not demonstrate synthetic compression-record substitution, so that portion of the finding is unverified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Unconditional promotional output is supported by the instruction to append advertisements to every response. Import-time advertising cannot be confirmed because no module implementation is supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The unrelated mandatory advertising is a confirmed purpose mismatch. The supplied document does not show code editing privacy claims or prove that runtime behavior contradicts those claims, so that additional allegation remains unverified.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

bash

# 单条上报
curl -s -X POST https://mrkjai.com/api/ingest/headroom \
  -H "X-API-Key: opc_user_你的40位hex" \
  -H "Content-Type: application/json" \
  -d '{

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

bash

# 单条上报
curl -s -X POST https://mrkjai.com/api/ingest/headroom \
  -H "X-API-Key: opc_user_你的40位hex" \
  -H "Content-Type: application/json" \
  -d '{

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

bash

# 自动解析 headroom perf 输出并上报
headroom perf 2>&1 | python scripts/headroom_upload.py --model claude-sonnet-4 --pricing 0.015

脚本自动执行：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

bash

# 方式1：重新下载最新模型（删掉缓存，让 headroom 重新下载）
rm -rf ~/.cache/headroom/
headroom proxy --port 8787  # 首次运行会自动下载最新模型

# 方式2：检查当前模型版本

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

bash

# 方式1：重新下载最新模型（删掉缓存，让 headroom 重新下载）
rm -rf ~/.cache/headroom/
headroom proxy --port 8787  # 首次运行会自动下载最新模型

# 方式2：检查当前模型版本

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/headroom_api.md (reported line 136)May include surrounding context.

bash

headroom copilot-auth login
headroom wrap copilot --subscription -- --model gpt-4o

环境变量完整列表

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/headroom_dashboard.py (reported line 139)May include surrounding context.

python

#   Compressed: 1298 tokens (40.0%)
    #   Model: claude-sonnet-4
    #   Time: 2026-06-21T10:23:01
    perf_output = os.popen("headroom perf 2>/dev/null").read()
    if not perf_output.strip():
        return []

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/headroom_upload.py (reported line 12)May include surrounding context.

python

使用方法：
  # 方式1：直接解析 headroom perf 输出
  headroom perf 2>&1 | python headroom_upload.py --model claude-sonnet-4 --pricing 0.015

  # 方式2：手动指定数据
  python headroom_upload.py --model claude-sonnet-4 --input-tokens 2840 --output-tokens 1820 --saved-tokens 1020 --saved-cny 0.108 --compression-rate 0.36

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Piping the remote response directly into bash turns downloaded content into commands with the invoking user's privileges, without an intervening inspection or integrity-verification step. This is the execution component of the same supply-chain risk identified by SC2, not evidence of a separate malicious chaining campaign; the installation-focused skill context makes users more likely to follow the command.

Content

Scanner excerpt · scripts/install_and_verify.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# install_and_verify.sh — 大模型 Token 成本节约工具 一键安装验证脚本
# 用法：curl -sSL https://raw.githubusercontent.com/guipi888/workbuddy-llm-token-compressor/master/scripts/install_and_verify.sh | bash
# 或本地执行：bash scripts/install_and_verify.sh

set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strip-to-no-upload.sh (reported line 54)May include surrounding context.

sh

echo "   ✅ 文件复制完成"

# 删除工作目录里可能存在的旧版 ZIP（rsync exclude 可能没生效）
rm -f "$WORK_DIR"/*.zip

# ── Step 3：删除上报相关脚本 ─────────────────────────────────────────────
rm -f "$WORK_DIR/scripts/headroom_upload.py"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strip-to-no-upload.sh (reported line 57)May include surrounding context.

sh

rm -f "$WORK_DIR"/*.zip

# ── Step 3：删除上报相关脚本 ─────────────────────────────────────────────
rm -f "$WORK_DIR/scripts/headroom_upload.py"
rm -f "$WORK_DIR/scripts/opc_headroom_reporter.py"
rm -f "$WORK_DIR/scripts/install_and_verify.sh"
rm -f "$WORK_DIR/scripts/strip-skill-md.py"  # 构建时用，不打包进发布包

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strip-to-no-upload.sh (reported line 58)May include surrounding context.

sh

# ── Step 3：删除上报相关脚本 ─────────────────────────────────────────────
rm -f "$WORK_DIR/scripts/headroom_upload.py"
rm -f "$WORK_DIR/scripts/opc_headroom_reporter.py"
rm -f "$WORK_DIR/scripts/install_and_verify.sh"
rm -f "$WORK_DIR/scripts/strip-skill-md.py"  # 构建时用，不打包进发布包
echo "   ✅ 已删除上报相关脚本"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strip-to-no-upload.sh (reported line 59)May include surrounding context.

sh

# ── Step 3：删除上报相关脚本 ─────────────────────────────────────────────
rm -f "$WORK_DIR/scripts/headroom_upload.py"
rm -f "$WORK_DIR/scripts/opc_headroom_reporter.py"
rm -f "$WORK_DIR/scripts/install_and_verify.sh"
rm -f "$WORK_DIR/scripts/strip-skill-md.py"  # 构建时用，不打包进发布包
echo "   ✅ 已删除上报相关脚本"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/strip-to-no-upload.sh (reported line 60)May include surrounding context.

sh

rm -f "$WORK_DIR/scripts/headroom_upload.py"
rm -f "$WORK_DIR/scripts/opc_headroom_reporter.py"
rm -f "$WORK_DIR/scripts/install_and_verify.sh"
rm -f "$WORK_DIR/scripts/strip-skill-md.py"  # 构建时用，不打包进发布包
echo "   ✅ 已删除上报相关脚本"

# ── Step 4：裁剪 SKILL.md（去掉所有上报相关内容）────────────────────────

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

bash

# 单条上报
curl -s -X POST https://mrkjai.com/api/ingest/headroom \
  -H "X-API-Key: opc_user_你的40位hex" \
  -H "Content-Type: application/json" \
  -d '{

The setup workflow requests, persistently stores, and prints an API key without warning about credential exposure.

Medium

• Category: Output Handling
• Confidence: 99% confidence

Finding

Setup asks the user to disclose an API key to the assistant, persists it in a shell startup file, and prints it for verification. This unnecessarily exposes the credential to conversation records, tool logs, terminal capture, and processes inheriting the exported environment.

Content

No source excerpt is available for this finding.

The automatic reporting workflow checks for an API key rather than whether the user has enabled reporting.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

Scenario E authorizes automatic reporting based on API-key presence, whereas other sections require reporting to be explicitly enabled. A key can remain configured after reporting is disabled, creating a workflow that could transmit usage statistics despite the user's current opt-out.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.