Security audit

AI KEY

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed router for AI KEY workflows, but it asks the agent to inventory local skills and reveal real filesystem paths, so it needs review before installation.

Install only if you are comfortable with this skill reading local AI KEY-related configuration, memory, and installed-skill metadata, and with it using a shell script to list installed aikey skills and their real paths. Prefer explicit /aikey commands over broad natural-language triggers, and review the local vault/memory behavior before using it with private business or content data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a conversational router, but it instructs the agent to enumerate locally installed skills, read local SKILL.md files, and expose real source paths. That expands its capability from user-facing routing into local environment discovery, which can leak filesystem structure and installed-tool inventory to the user or downstream prompts.

Vague Triggers

High

Confidence: 98% confidence
Finding: The trigger phrases are broad everyday expressions like 'make a short video' or 'what should I shoot today,' which can cause accidental activation in unrelated conversations. Because this skill can route tasks and, per its instructions, perform local skill discovery, overbroad invocation raises the chance of unintended behavior and unnecessary exposure of system capabilities.

Ae1

High

Category: analysis-evasion
Content: 选定之后，**完整读**入选技能的 `SKILL.md` 和它点名要读的直接引用。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: Lines L035-L037 state that this skill is a triage desk and explicitly says topic selection, writing, scoring, and diagnosis are not done here, except for a compressed demo. However, the onboarding flow later directs the skill to run actual content feasibility judgments and business prioritization analysis on the user's real situation, producing concrete recommendations rather than just routing. That exceeds the narrow 'public entry point' behavior described as its main boundary.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The onboarding section routes directly into newbie mode for broad free-form phrases such as “第一次用”, “带我走一遍”, and “安装好了然后呢”. These phrases can arise in many contexts, and the file does not define required context or non-matching examples to distinguish true onboarding requests from ordinary conversation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs execution of a local shell script to discover installed skills and their true source paths. Running shell commands from a broadly triggered conversational router increases attack surface, and the returned inventory/path data can expose sensitive local environment details that are unrelated to the user's task.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: In onboarding constraints, L339-L341 says the mode should not run complete skills and should not write files. Yet L430-L445 says if the user selects option 1, the skill should immediately run Mode A Step 1-7 'for real' on the user's actual task. This creates an internal contradiction in the documentation about whether onboarding is only a demo or transitions into real execution behavior.

Static analysis

No suspicious patterns detected.