挑选Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 6.5.0

Overview

SkillPick is a coherent skill-recommendation tool; the main caution is that development-mode local query logging can occur if a data directory is present.

Installers should understand that SkillPick recommends third-party skills and may print direct install URLs, including some security or red-team tools. Treat catalog descriptions as recommendation data, verify any recommended skill before installing it, and remove or monitor artifact/data/search_log.jsonl if running from a development checkout with a data directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (20)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills_data.js (reported line 1)May include surrounding context.

js

native m · 13维质量优秀 · 高置信度 · 零门槛安装 · 4星好评","vs_note":""},{"name":"viper","score":82,"final_score":122,"display_score":122,"quality_score":90,"quality_grade":"A+","confidence":"high","stars":4,"desc":"Adversary simulation and Red teaming platform with AI","source":"github","region":"GLOBAL","is_cn":false,"tags":["agent","ai","cobalt-strike","llm","mcp-server","metasploit-framework","post-exploitation","red-team-tools","redteam","viper"],"tags_enhanced":["agent","ai","cobalt-strike","llm","mcp-server","metasploit-framework","post-exploitation","red-team-tools","redteam","viper"],"highlights":[],"install_method":"direct","install_url":"https://github.com/FunnyWolf/Viper","install_hint":{"method":"direct","hint":"直接安装: https://github.com/FunnyWolf/Viper","url":"https://github.com/FunnyWolf/Viper"},"cat":"AI Agent","chart_count":1,"chart_list":["github"],"best_in_track":false,"recommend_reason":"Adversary simulation and · 13维质量优秀 · �

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · CLAUDE.md (reported line 78)May include surrounding context.

md

Grades: A+(≥85) · A(70-84) · B+(55-69) · B(45-54) · C(30-44) · D(<30)

Safety dimension uses **one-vote-veto**: `curl | bash` patterns, destructive `rm -rf`, eval execution → score goes negative → D-grade → blocked from recommendations.

### Scoring Formula for Search/Recommendations

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skills_data.js (reported line 1)May include surrounding context.

js

semantic AI search via reddit-insights.com MCP server.\nUse when you need to: (1) Find user pain points and frustrations for product ideas, (2) Discover niche markets or underserved needs, (3) Research what people really think about products/topics, (4) Find content inspiration from real discussions, (5) Analyze sentiment and trends on Reddit, (6) Validate business ideas with real user feedback.\nTriggers: reddit search, find pain points, market research, us","source":"skillhub","region":"GLOBAL","is_cn":false,"tags":["data-analysis"],"tags_enhanced":["data-analysis","search","ai","mcp","reddit","insights","数据分析"],"highlights":[],"install_method":"direct","install_url":"https://api.skillhub.cn/dowands/reddit-insights","install_hint":{"method":"direct","hint":"安装: https://api.skillhub.cn/dowands/reddit-insights","url":"https://api.skillhub.cn/dowands/reddit-insights"},"cat":"数据分析","chart_count":1,"chart_list":["skillhub"],"best_in_track":false,"recommend_reason":"Sea

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes the skill as usable by an 'Agent' via CLI, but it does not define concrete invocation phrases, scope boundaries, or negative examples for when the skill should versus should not be selected. That ambiguity can cause unintended activation for broad recommendation requests rather than clearly constrained skill-selection tasks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents executable CLI entrypoints and a data pipeline that imply shell and likely network access, but it does not declare any explicit tool scope or permission boundaries. This can cause an agent runtime to grant broader capabilities than intended or leave reviewers unable to verify least-privilege expectations, increasing the risk of unintended command execution, outbound requests, or unsafe dataset collection behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing natural-language instructions, descriptions, and CLI examples entirely in Chinese, but it does not indicate that Chinese is optional or that the skill is intended only for a Chinese-language audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Natural-language strings throughout the file present usage, descriptions, and output exclusively in Chinese, which imposes a specific language/locale on users. The policy allows locale constraints only when explicitly documented and justified or when users are offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI persistently records user queries and top results to a local JSONL file, even though the skill is presented as a recommendation/decision guide rather than a telemetry-collecting tool. Search terms and workflow names can contain sensitive business intent, internal project names, or personal data, so undisclosed retention creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User search and workflow queries are written to disk without any user-facing notice, consent, or configuration prompt. Because this tool's inputs may reveal user interests, procurement plans, operational needs, or internal terminology, silent persistence creates a meaningful privacy and compliance risk even if the data stays local.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · index.html (reported line 1032)May include surrounding context.

html

if (install === 'direct') installSignal = getSignals().direct_install;
  else if (dims.install && dims.install >= 80) installSignal = getSignals().easy_install;

  var depList = details.dependencies || [];
  var hasNoDep = depList.some(function(d) { return d.indexOf('无显式依赖') >= 0 || d.indexOf('无依赖') >= 0; });
  var depSignal = hasNoDep ? getSignals().no_dep : '';

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · index.html (reported line 1033)May include surrounding context.

html

if (install === 'direct') installSignal = getSignals().direct_install;
  else if (dims.install && dims.install >= 80) installSignal = getSignals().easy_install;

  var depList = details.dependencies || [];
  var hasNoDep = depList.some(function(d) { return d.indexOf('无显式依赖') >= 0 || d.indexOf('无依赖') >= 0; });
  var depSignal = hasNoDep ? getSignals().no_dep : '';

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · index.html (reported line 1041)May include surrounding context.

html

if (install === 'direct') installSignal = getSignals().direct_install;
  else if (dims.install && dims.install >= 80) installSignal = getSignals().easy_install;

  var depList = details.dependencies || [];
  var hasNoDep = depList.some(function(d) { return d.indexOf('无显式依赖') >= 0 || d.indexOf('无依赖') >= 0; });
  var depSignal = hasNoDep ? getSignals().no_dep : '';

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skills_data.js (reported line 1)May include surrounding context.

js

"confidence":"high","stars":3,"desc":"Know what your competitors ship before their customers do. Automated monitoring of competitor websites, product pages, pricing, content, and social presence. Detects changes, extracts new features, tracks pricing updates, and alerts you with digestible summaries. Your agent watches the competition 24/7 so you can focus on building. Configure competitor tiers (fierce rivals get deep monitoring, adjacents get high-level), set check frequency, define alert thresholds, and receive smart diffs highli","source":"skillhub","region":"GLOBAL","is_cn":false,"tags":["content-creation"],"tags_enhanced":["content-creation","automation","competitor","watch","内容创作"],"highlights":[],"install_method":"direct","install_url":"https://api.skillhub.cn/audsmith28/competitor-watch","install_hint":{"method":"direct","hint":"安装: https://api.skillhub.cn/audsmith28/competitor-watch","url":"https://api.skillhub.cn/audsmith28/competitor-watch"},"cat":"内容创作"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file switches into Chinese for the multi-agent workflow section and agent role descriptions, while earlier sections are in English. Because the file does not state that the skill is intended specifically for Chinese-speaking users or offer an alternative language, it can violate the language/locale policy requiring user choice or justified locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language instructions and examples in this file are entirely in Chinese, but the document does not indicate that the skill is intentionally region-specific or provide an opt-in language choice. That can violate language/locale policy when a skill implicitly forces one language for all users or agents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The description includes the Chinese name "挑选Skill" inline within the English file, which can imply a language expectation not fully aligned with the file's English audience. Because no explicit language-selection or locale guidance is provided here, this may conflict with a policy preferring user language opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example node api.js workflow 短视频带货 introduces a Chinese-language scenario in the English skill file, but the surrounding documentation does not say whether non-Chinese users can provide English equivalents or choose their locale. This can be read as favoring a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment claims logging is limited to local development mode, but the actual condition is merely the presence of a data directory. This mismatch can cause logging to occur in packaged or semi-production environments unexpectedly, undermining operator expectations and increasing the chance of accidental data collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document is declared with lang="zh-CN", which makes Chinese the default locale for all users on first load. Although a language toggle exists later, the initial forced locale is a language-policy concern because the user is not first offered a choice or explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.