58区块同城

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about its blockchain/NFT purpose, but it asks for local file read/write access that its documented workflows do not need and describes transaction-like NFT activity without clear safeguards.

Install only if you are comfortable granting this skill network access and potentially unnecessary local file access. Treat NFT, wallet, purchase, trading, and governance steps as financial actions: verify sites and wallet prompts yourself, never share seed phrases or private keys, and require explicit confirmation before any transaction.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:8

Finding

Unnecessary Local Filesystem Read and Write Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

permissions: \["network", "file.read", "file.write"]

Technical Analysis

The skill requests file.read and file.write permissions even though its documented implementation only retrieves city and NFT-related information from remote websites. Neither SKILL.md nor README.md identifies a workflow that requires reading from or writing to the local filesystem.

Granting capabilities unrelated to the skill's stated purpose violates the principle of least privilege. If the host maps these declarations to effective filesystem access without additional path restrictions, the skill would possess a broader security boundary than needed. This unnecessary access could become exploitable if the skill instructions, remote content processed by the agent, or a future skill update were compromised.

Attack Path

1. A user installs or enables the skill for city rankings, digital-city information, or NFT-related operations.
2. The host grants the permissions declared in SKILL.md, including local file read and write access.
3. The skill retrieves and processes externally controlled content from the documented remote service, or its instructions are maliciously modified in a later update.
4. Compromised instructions invoke the unnecessary filesystem capabilities.
5. Files accessible to the host process may be read, disclosed through network access, modified, or overwritten.

This exploitation path is conditional on the host enforcing the declared permissions as effective capabilities and on malicious instructions or content reaching the agent. The repository itself contains no executable malicious payload.

Impact Assessment

Potential impact includes unauthorized access to files available to the agent process, disclosure of loca ...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove file.read and file.write from the permission declaration because the documented functionality only requires network access:

   yaml

   permissions: \["network"]
   

2. If local persistence is later required, document the precise business requirement and request only the minimum necessary capability.

3. Restrict any required filesystem access to a dedicated application data directory rather than granting general local file access.

4. Prevent access to wallet files, SSH keys, browser profiles, environment files, credentials, and operating-system configuration.

5. Require explicit user confirmation before reading or modifying files and before performing wallet, NFT purchase, trading, voting, or governance operations.

6. Apply host-level sandboxing and deny filesystem access by default, independently of the skill manifest.

7. Add automated manifest validation to reject permissions that are not exercised or justified by the documented implementation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes NFT purchases, wallet use, and account-dependent features but does not warn users about financial loss, scams, irreversible blockchain transactions, price volatility, or wallet security. In a consumer-facing skill tied to blockchain assets, this omission can mislead users into risky actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly promotes browsing, purchasing, trading, and managing NFT assets, but it does not present clear risk disclosures about financial loss, scams, irreversible blockchain transactions, wallet compromise, or jurisdictional/compliance issues. In a user-facing agent skill, this can mislead users into treating high-risk financial actions as routine informational tasks, increasing the chance of harmful or uninformed transactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language content appears to require Chinese comprehension to use the skill, but there is no indication that this language constraint is optional or region-specific. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.