help stay focus . currently only support chinese

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:10 PM UTC
• Version: 1.0.1

Overview

This skill is openly for screen monitoring and activity recall, but its install path runs unpinned external code and its triggers can access sensitive screen history too broadly.

Install only if you are comfortable with a local service taking periodic screenshots, storing activity history, and sending screenshots to configured visual model providers. Review or pin the GitHub code before running start.bat, and use the skill only for explicit FocusAI monitoring or history requests.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:153

Finding

Execution of Unpinned Code Retrieved from an External Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 153-160
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

# Clone repository
git clone https://github.com/HR2AY/focusAI

# Windows: run start.bat to configure the environment and start the service
cd focusAI && start.bat

Technical Analysis

The installation instructions clone the mutable default branch of an external GitHub repository and immediately execute its start.bat file. The repository is not pinned to a reviewed commit or immutable release, and the instructions do not require signature or checksum verification before execution.

Consequently, the code executed by users can differ from the code that existed when this Skill was audited. The external repository is not included in the audited project, so the behavior of start.bat, its dependencies, and any subsequent downloads cannot be verified from the available artifact.

This issue best matches T03: Remote Payload Retrieval and Execution because the Skill establishes a direct retrieval-and-execution path whose effective payload can be modified after review.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or another mechanism capable of modifying its default branch.
2. The attacker replaces or modifies start.bat, or code launched by that file, with malicious commands.
3. A user follows the Skill's installation instructions and clones the current repository contents.
4. The user runs cd focusAI && start.bat without validating the downloaded content.
5. The attacker-controlled commands execute locally with the same privileges and environmental access as the user who launched the batch file.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. Depending on that account's existing privileges, malicious upstream code co ...[truncated 344 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a specific, reviewed commit hash or immutable signed release rather than the repository's mutable default branch.
2. Publish an expected SHA-256 or stronger cryptographic digest for every downloaded artifact and require verification before execution.
3. Verify release signatures against a documented, trusted maintainer key.
4. Separate retrieval from execution and instruct users to inspect the downloaded scripts before running them.
5. Prefer bundling the reviewed installation code inside the audited Skill package when practical.
6. Run installation and monitoring components with least privilege; do not require administrator rights unless a documented operation strictly needs them.
7. Pin and validate any transitive dependencies downloaded by start.bat.
8. Add explicit failure behavior that stops installation when a signature, checksum, commit identity, or source validation check fails.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The title, trigger phrases, required user-facing messages, and operational guidance are all specified in Chinese, and the file does not indicate that users may choose another language. This can constitute a language/locale policy issue because the skill appears to force a specific interaction language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill expands invocation scope beyond concrete trigger patterns by framing FocusAI as the agent's general 'eyes' and 'diary' for past digital activity and screen recollection. That can cause the agent to over-trigger privacy-sensitive monitoring/history features in ordinary conversation, increasing the chance of accessing or exposing screen-activity data without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger guidance provides only example phrases and says the agent should 'immediately' recognize the need to call the skill, but it does not define exclusion conditions or ambiguity handling. In practice this can bias the agent toward premature tool use, leading to unnecessary access to local history or monitoring APIs when a plain-language response or clarification would be safer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.