Security audit

智能技能推荐器

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a skill recommender, but its instructions also tell the agent to install third-party skills despite claiming read-only, no-shell behavior.

Review this skill carefully before installing. Its search and recommendation behavior is reasonable, but do not let it install other skills automatically unless you separately confirm the source, permissions, and trustworthiness of the selected skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata and description position the capability as recommendation-only, but the documented workflow later expands into automatic installation after user selection. This is dangerous because it changes the trust boundary and enables acquisition/execution of third-party content, which materially increases supply-chain risk and user surprise.

Scope Creep

High

Confidence: 99% confidence
Finding: The documented install flow writes downloaded content into ~/.workbuddy/skills/<slug>/, which exceeds the declared read-only filesystem permission. This creates a misleading permission model where reviewers and users may trust the skill as non-mutating while it describes persistence to disk.

Scope Creep

High

Confidence: 99% confidence
Finding: The ClawHub installation path invokes an external command via npx despite the skill declaring shell access as disallowed. This is dangerous because shelling out to package managers can fetch and execute untrusted code, bypassing the security expectations set by the manifest.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The security section claims the skill only reads data and performs no write/modify actions, yet earlier sections describe downloading and installing skills to disk. Contradictory security claims can mislead users and reviewers into approving a capability set that is broader and riskier than disclosed.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger keywords are broad conversational phrases such as '推荐', '找个', and '有什么', which can cause accidental activation during normal chat. In a network-enabled skill, unintended triggering can lead to unplanned remote queries and disclosure of user prompts to external services.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The remote search workflow sends the user's request and extracted keywords to external services, but the main description does not prominently warn that user input leaves the local environment. This is risky because users may include sensitive business or personal information in natural-language requests without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The installation workflow describes automatic download/install behavior after a user chooses a result, but the main workflow lacks a strong safety warning about supply-chain, permission, and provenance risks. That omission makes users more likely to approve installation of third-party skills without understanding the consequences.

Static analysis

No suspicious patterns detected.