Security audit

胖叔 Skill 安全审查

Security checks for vulnerabilities and agentic risk

Overview

This is a purpose-aligned local skill scanner, but its results should be treated as advisory because its pattern checks can miss risky skill instructions.

Installing this skill is reasonable if you want an advisory pre-install scanner, but do not rely on it as the only approval gate. It uses simple regex checks and can miss malicious instructions in normal Markdown prose, so pair it with manual review or a stronger scanner for untrusted skills.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vetter.py:130
Finding: Security Scanner Bypass Through Unconditional Source-Line Filtering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
### 🔴 Critical (Block Install) | Check | Pattern | Action | |-------|---------|--------| | Disk wipe | `rm -rf /`, `rm -rf ~`, `dd if=.*of=/dev/sdX` | BLOCK | | Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
### 🔴 Critical (Block Install) | Check | Pattern | Action | |-------|---------|--------| | Disk wipe | `rm -rf /`, `rm -rf ~`, `dd if=.*of=/dev/sdX` | BLOCK | | Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
### 🔴 Critical (Block Install) | Check | Pattern | Action | |-------|---------|--------| | Disk wipe | `rm -rf /`, `rm -rf ~`, `dd if=.*of=/dev/sdX` | BLOCK | | Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
### 🔴 Critical (Block Install) | Check | Pattern | Action | |-------|---------|--------| | Disk wipe | `rm -rf /`, `rm -rf ~`, `dd if=.*of=/dev/sdX` | BLOCK | | Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK | | System takeover | `chmod 777.*shadow`, `/etc/passwd` edit | BLOCK | ### 🟡 Medium (Warn + Allow) | Check | Pattern | Action |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK | | System takeover | `chmod 777.*shadow`, `/etc/passwd` edit | BLOCK | ### 🟡 Medium (Warn + Allow) | Check | Pattern | Action |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
| Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK | | System takeover | `chmod 777.*shadow`, `/etc/passwd` edit | BLOCK | ### 🟡 Medium (Warn + Allow) | Check | Pattern | Action |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vetter.py (reported line 75)May include surrounding context.
python
WARNING_PATTERNS = [ (r'curl.*\|.*sh', 'Curl pipe to shell'), (r'wget.*\|.*sh', 'Wget pipe to shell'), (r'\.env', 'Environment file access'), (r'\.aws/', 'AWS credentials access'), (r'ssh-keygen', 'SSH key generation'), (r'chmod\s+[0-7]{3,4}', 'Permission change'),

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises behavior that scans skill code and invokes a Python script, implying file-read and likely shell execution capabilities, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an installer or orchestrator may grant broader capabilities than intended, increasing the blast radius if the skill is abused or misrouted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The automatic invocation conditions are described broadly, such as before installs, updates, or when users ask to "vet" or "check" a skill, without precise scoping rules. Ambiguous trigger boundaries can lead to accidental invocation, unexpected access to files, or security workflow disruption through false activations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The automatic invocation conditions are described broadly, such as before installs, updates, or when users ask to "vet" or "check" a skill, without precise scoping rules. Ambiguous trigger boundaries can lead to accidental invocation, unexpected access to files, or security workflow disruption through false activations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK | | System takeover | `chmod 777.*shadow`, `/etc/passwd` edit | BLOCK | ### 🟡 Medium (Warn + Allow) | Check | Pattern | Action |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
| Fork bomb | `:(){ :\|:& };:`, `fork()` loop | BLOCK | | Format | `mkfs`, `newfs`, `umount -f` | BLOCK | | SSH key deletion | `rm.*\.ssh/`, `ssh-keygen.*-D` | BLOCK | | System takeover | `chmod 777.*shadow`, `/etc/passwd` edit | BLOCK | ### 🟡 Medium (Warn + Allow) | Check | Pattern | Action |

Static analysis

No suspicious patterns detected.