cjg-skill-forge

• Outcome: Review
• Latest audit: Aug 27, 2026 · 5:39 PM UTC
• Version: 3.1.2

Overview

This is a real skill-building toolkit, but it bundles broad local telemetry, cloud-sync behavior, and unsafe validation paths that users should review before installing.

Install only if you are comfortable with a skill that manages other skills, creates local telemetry logs by default, and can contact configured cloud services. Use it on skills you control, keep cloud sync off unless you understand the destination endpoints, and avoid running inject/check against untrusted skill directories without sandboxing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (63)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not main_py:
        return (True, "未探测到主脚本（scripts/main.py 等），跳过冒烟（不阻断）")
    try:
        r = subprocess.run([sys.executable, main_py, "--help"],
                           capture_output=True, text=True, encoding="utf-8", timeout=60)
    except subprocess.TimeoutExpired:
        return (False, f"主脚本 --help 超时（疑似死循环/阻塞）: {main_py}")

• Confidence: 88% confidence
• Finding: The script executes a target skill's detected main Python file as part of a '--help' smoke test. Because the target directory is attacker-controlled input, a malicious skill can place arbitrary code in its entrypoint and that code will run during injection/check, turning validation into code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not main_py:
        return (True, "未探测到主脚本（scripts/main.py 等），跳过冒烟（不阻断）")
    try:
        r = subprocess.run([sys.executable, main_py, "--help"],
                           capture_output=True, text=True, encoding="utf-8", timeout=60)
    except subprocess.TimeoutExpired:
        return (False, f"主脚本 --help 超时（疑似死循环/阻塞）: {main_py}")

• Confidence: 98% confidence
• Finding: The script executes the target skill's discovered entrypoint via `subprocess.run([sys.executable, main_py, "--help"])` during smoke testing. Because `main_py` is selected from the target skill directory, a malicious or compromised skill can place arbitrary code in its entry script and have it executed simply by running the injector/checker, turning validation into code execution.

Tainted flow: 'req' from open (line 213, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

cc["report_url"] + "/report",
                        data=json.dumps({"action": "health"}).encode("utf-8"),
                        headers={"Content-Type": "application/json"}, method="POST")
                    with urllib.request.urlopen(req, timeout=10) as resp:
                        h = json.loads(resp.read())
                    check("[平台] cjg-report health（9 文件已加载）",
                          bool(h.get("ok")) and bool(h.get("playbooks_loaded")), str(h)[:120])

• Confidence: 82% confidence
• Finding: The code loads endpoint configuration from `cloud_config.json` and then performs an outbound POST to `report_url` with only a superficial `https://` prefix check. If that config file is modified by an attacker or untrusted tooling, the script can be induced to contact an attacker-controlled endpoint, enabling SSRF-style behavior, internal service probing, or exfiltration of environment/network metadata through CI or developer machines.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents shell, file read/write, environment discovery, and network-dependent workflows but does not declare corresponding permissions. This creates a capability-transparency gap: users or reviewers may invoke the skill believing it is low-privilege, while the instructions direct execution of local scripts, filesystem writes, and optional cloud sync that can affect the host or exfiltrate metadata.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest presents the skill as a skill-building/auditing meta-tool, but the body adds telemetry logging, cloud synchronization, proposal retrieval, and scheduled reporting. That scope expansion is dangerous because users may consent to a narrowly understood authoring tool while the skill also performs persistence and networked data flows outside the core advertised purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The config defines five external cloud endpoints for ingesting, registering, proposing, aggregating, and reporting data, while the skill is described as a local skill-forging/auditing utility with no clear disclosure of remote data flows. This mismatch creates a real security and trust issue because users may provide sensitive skill content, local inventory details, or audit artifacts under the assumption they remain local, when they may instead be transmitted to third-party infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file defines objective usage telemetry and action-trace collection that goes beyond narrow skill-forging content and into broader behavioral monitoring. Even though it claims anonymization and opt-in controls, this expands data collection scope and creates privacy and compliance risk if users do not clearly understand the breadth of tracking.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document says logs never include file names or paths, but the edit-capture design records relative paths in the note field. That contradiction can mislead users and reviewers about what is actually collected, causing unauthorized leakage of project structure or sensitive file naming conventions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The privacy redline states that file names and paths are never recorded, but elsewhere the skill explicitly logs relative paths for edit-capture events. This kind of policy/behavior mismatch is dangerous because operators may rely on false privacy guarantees while the system still emits metadata that can reveal sensitive repository structure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script generates run_verified.py from commands scraped out of references/*_evidence.md and then provides an --exec mode that runs those commands. Because the evidence files are treated as trusted input with no validation, a malicious or tampered evidence file can inject arbitrary shell commands into the generated runner, turning a documentation artifact into code execution.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script claims the scan scope is locked to `~/.workbuddy/skills`, but `SKILLS_DIR = os.environ.get("SKILLS_DIR", DEFAULT_SKILLS_DIR)` allows the effective scan root to be changed. That mismatch can cause operators or downstream tooling to trust the scanner's confinement guarantees when it may actually read arbitrary local directories if launched with a modified environment.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The session hook claims to handle local session-signoff tracking, but cmd_start also silently triggers upload_signals.py and download_signals.py. That expands the hook's trust boundary from local bookkeeping to network-capable sync behavior, which can cause unexpected data transfer or state changes during a supposedly quiet local lifecycle event.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring states the hook only writes local method-level labels and does not read user files, but the implementation reads multiple local files such as .optin, .anon_id, SKILL.md, and .session_state.json, and also invokes sync helpers. This mismatch undermines informed consent and can mislead users or reviewers about what the hook actually accesses and does.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script performs external network retrieval and modifies a local telemetry log, which is behavior materially outside the stated purpose of a skill-forging/auditing meta-skill. Even if framed as signal synchronization, this creates a covert data movement and persistence capability inside a skill package, increasing the risk of unauthorized telemetry collection, unexpected outbound access, and local state tampering in environments that may trust skills to be mostly prompt/config assets.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code reads a global secrets/config location and an environment variable to resolve an external aggregation endpoint, then uses that endpoint to retrieve data. In the context of a meta-skill whose declared purpose is skill creation/review, this undisclosed access to shared config and remote services expands the trust boundary and can leak environment metadata or enable silent communication with attacker-controlled infrastructure if configuration is poisoned.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The injector performs outbound reachability checks against URLs from `cloud_config.json` and inspects registration state, expanding behavior beyond local file injection. In an adversarial target skill, this can trigger unexpected network access to attacker-controlled endpoints, leak environment/network metadata, or violate operator expectations that validation is offline and local.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The smoke-test feature intentionally executes arbitrary target skill entrypoints discovered in the analyzed directory. That means any attacker who can supply or modify a target skill can get code run under the analyst/operator account during a supposedly diagnostic workflow, with access to local files, network, and user permissions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The injector bootstraps `.optin=on` by default and adds cloud-integration scaffolding into target skills. Even if cloud upload defaults off, enabling local recording automatically across injected skills creates privacy and consent risk, especially because the injector modifies third-party skills' behavior at install time rather than requiring explicit end-user opt-in first.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script generates `run_verified.py`, which replays commands extracted from evidence markdown and later executes them with `subprocess.run(..., shell=True)`. Because the source commands come from documentation-like files that may be modified or contain unsafe shell syntax, this creates a code-execution path where untrusted or insufficiently validated content is turned into executable shell commands.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring states the scanner is scope-locked to `~/.workbuddy/skills/`, but `SKILLS_DIR = os.environ.get("SKILLS_DIR", DEFAULT_SKILLS_DIR)` permits silent environment-based override to any directory. In agent or automation contexts, that mismatch can cause the tool to scan unintended filesystem locations and read arbitrary `SKILL.md` files outside the declared trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented purpose of the session hook is local no-signoff/session-state handling, but cmd_start also performs upload and download sync operations. That mismatch creates hidden network-capable behavior in a hook expected to be silent and local, which can transmit telemetry or alter local state without clear user awareness or consent at the point of execution.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This skill is primarily framed as a skill-forging/auditing utility, yet the hook contains hidden telemetry collection and synchronization behavior through upload_signals.py and download_signals.py. In this context, undisclosed or weakly disclosed telemetry is more dangerous because users may invoke the skill for authoring/review tasks and not expect background collection or network transfer tied to session lifecycle events.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script reads a user-scoped config/secrets path under ~/.workbuddy/secrets to auto-discover a report endpoint, which expands its trust boundary beyond the stated local scoring task. If that file is poisoned or unexpectedly present, users may send skill content and tokens to an attacker-controlled URL without realizing the endpoint was sourced from a sensitive per-user configuration location.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: In cloud mode, the script serializes and transmits the full skill content and reference names to an external endpoint. Skills can contain proprietary instructions, secrets, or internal operational details, so this creates a real data exfiltration risk if the remote service is untrusted, misconfigured, or attacker-controlled via endpoint manipulation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script reaches outside the skill directory and reads a creator-wide secrets configuration from ~/.workbuddy/secrets/cjg-evo/cloud_config.json to obtain an upload endpoint. That broadens the skill's effective authority and creates hidden coupling to global machine state, enabling cross-context exfiltration if the config is present, even though this behavior is not justified by the declared skill purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.