Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed developer disk-audit and cleanup skill with guarded local cleanup controls, but users should review each deletion choice carefully.
Install only if you want a developer-environment disk scanner and are comfortable sharing local path/size metadata with your agent. Use the read-only scan first, then run the cleaner in --dry-run mode and select only entries you personally recognize as disposable; do not treat the fixed residue labels as proof that an active version manager is unused.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (32)
Tp4
High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description is narrowly about an 'env doctor' that analyzes local disk usage from development tools and supports selective cleanup decisions. The supplied code chunk instead is a top-level runner for a three-part doctor suite. Two of its three main actions are unrelated to disk-space cleanup: checking AGENTS.md/CLAUDE.md and auditing project-local skills. While it does invoke an env-doctor scan script, this chunk does not implement the advertised core behaviors such as per-directory classification, stale-tool detection, cleanup guidance, or interactive deletion. Therefore the actual behavior is materially broader/different than the declared purpose, with undeclared capabilities and a different primary role.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The code matches part of the description: it scans local disk usage on Mac/Linux, focuses on developer-tool directories, and includes logic helpful for identifying stale version managers by checking shell loading, PATH presence, and runtime ownership. However, the declared description prominently promises a fuller 'doctor' that classifies items into three categories, gives official cleanup commands and cost explanations, and provides an interactive cleanup selector with guarded deletion behavior and dry-run support. None of those cleanup or interactive capabilities are present in this code chunk. Instead, the script is explicitly read-only and only emits raw scan data for later interpretation. This is a material description-versus-code mismatch, even if the scanner could be a supporting component of a larger system.
Content
No source excerpt is available for this finding.
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
The skill includes a destructive recursive deletion command, rm -rf "$HOME/.nvm", presented as an official cleanup action. Even though the surrounding text says the user must confirm and run commands manually, this still creates a meaningful risk of unsafe deletion because the skill is specifically designed to classify directories as safe to remove and may misclassify active data or be over-trusted by users.
Content
Scanner excerpt · references/report.md (reported line 64)May include surrounding context.
The README advertises activation on a very broad, everyday-language phrase like '磁盘满了，帮我看看什么占了空间'. In an agent-skill environment, broad triggers can cause the skill to activate in contexts where the user did not explicitly request this specific tool, increasing the chance of unnecessary local disk inspection and, if the workflow proceeds, presenting deletion options for sensitive development directories.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The visible user-facing name, summary, and full description are written in Chinese, and the document provides prescribed response phrasing in Chinese only. There is no statement offering multilingual output or asking the user for language preference, which can violate language/locale choice policy.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The trigger list is broad enough to activate on generic disk-space complaints, even when the user's issue may involve non-development files outside the skill's safe scope. In an agentic environment, over-broad routing can cause inappropriate local scanning of the user's home directory, producing unnecessary exposure of file-system metadata and potentially leading to risky cleanup guidance in the wrong context.
