Back to skill

Security audit

Q-ray

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent static project-scanning helper that reads repository metadata and writes local report files, with no evidence of network access, persistence, credential theft, or destructive behavior.

Install only if you are comfortable with a Chinese-language project-analysis helper that enumerates file paths in the target repository and creates local generated files such as qray-data.json and qray-report.html. Point it at the intended project directory, and avoid running it over folders containing sensitive filenames or private material you do not want summarized.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
声明描述的是一个较全面的陌生项目扫描与理解工具,涵盖项目类型、技术栈、架构、文件结构、复杂度和学习价值等多个维度。但实际代码仅实现了非常有限的技术栈探测:检查少数常见生态的配置文件是否存在,并解析 package.json 中的依赖名映射到预定义技术标签。它没有分析代码结构、架构模式、目录结构、复杂度,也没有任何关于学习价值的判断。因此,实际行为只覆盖声明中的一小部分,属于功能范围明显不符的描述。

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly plans to read project files and generate an HTML report, which implies file read and file write behavior, but it declares no explicit tool scope or permission boundaries. Without an allowlist, an agent may gain broader-than-necessary filesystem access, increasing the chance of reading sensitive files or writing outputs in unsafe locations despite the stated safety guidance.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
A language-only instruction set can violate organizational language/locale policy when it forces a specific language without user opt-in. This file presents the skill description and operating instructions exclusively in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language context.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The template declares `lang="zh-CN"` and all visible labels are written in Simplified Chinese, which imposes a specific language/locale in user-facing output. There is no indication in this file that users can opt into another language or that the locale restriction is required for a region-specific purpose.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The script hard-codes Chinese-only output labels for complexity levels, and the CLI usage message is also Chinese-only. This imposes a specific language on all users without opt-in or any documented region-specific rationale, which matches the natural-language locale policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The dictionary assigns Chinese descriptions to all reported file types, making the script's natural-language output Chinese-only by default. If organizational policy requires respecting user locale or offering a language choice, this is a natural-language policy concern because no opt-in or locale selection is provided.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The script prints all user-facing status messages in Chinese only, which imposes a specific language on all users. There is no opt-in, language selection, or documented justification that this skill is intended only for a Chinese-speaking or region-specific context.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
Line L2 presents the skill description only in Chinese, which constitutes a language-specific constraint in natural-language content. There is no indication of user opt-in, multilingual support, or a documented region-specific reason for limiting the skill description to this locale.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill states it will generate an independent HTML report but does not clearly disclose that it will create or overwrite a file in the workspace. Hidden write behavior can surprise users, alter repositories, or place generated HTML in locations that may later be trusted or published unintentionally.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The script prints a completion message in Chinese only (`✅ Q-ray 报告生成完成`). This is a natural-language locale choice imposed by the skill with no option to select another language, which matches the policy category for forced language/locale behavior.

Description-Behavior Mismatch

Low
Confidence
83% confidence
Finding
The manifest describes identifying project type, stack, architecture, structure, complexity, and learning value for quick understanding of a repository. In addition to scanning, this entrypoint writes the collected data to `qray-data.json`, which is a side effect not stated in the description and goes beyond purely returning or displaying analysis results.

Static analysis

No suspicious patterns detected.