T08 · Insecure Dependencies
Error
- Location
scripts/update_skill.py:243- Finding
Self-Update Integrity Verification Does Not Cover Every Installed File
- Content
View full analysis
- Remediation
View remediation
Security audit
enterprise-skills-studio
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed enterprise skill-building toolkit, but its self-update feature can rewrite skill files from remote archives with weaker-than-claimed integrity and broader filesystem scope than declared.
Use Review before installing in a managed environment. The safest posture is to disable write-capable self-update with ESS_SELF_UPDATE=off, allow only trusted repositories with ESS_ALLOWED_REPOS, avoid --apply --yes and non-default --repo unless an administrator has reviewed the exact diff, and run the tools with filesystem sandboxing appropriate to the selected target directories.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update_skill.py:199- Finding
Archive Extraction Accepts Symbolic Links, Hard Links, and Special Files
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/update_skill.py:481- Finding
Filesystem Capability Declaration Does Not Match User-Selectable Read and Write Targets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (79)
YARA rule 'php_webshell_known': Known PHP webshell families (c99, r57, b374k, WSO, etc.) [webshells]
Critical
- Category
- YARA Match
- Confidence
- 90% confidence
- Finding
YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).
- Content
python s|json|form))", re.I, ) RE_VALIDATE = re.compile( r"(校验|验证|清洗|转义|白名单|allowlist|sanitiz|脱敏|过滤)", re.I) RE_SINK = re.compile( r"(os\.system|subprocess|exec\s*\(|eval\s*\(|requests\.post|urllib\.request|http\.post|send\s*\()", re.I, ) # C16 YARA 启发式（恶意软件 / webshell / 挖矿） RE_MAL = re.compile( r"(stratum\+tcp|c99\.php|b374k|r57\.php|/xmr|monero|挖矿|xmrig|" r"webshell|菜刀|一句话木马)", re.I) RE_HTML_BUILD = re.compile(r"(<table|<div|<tr|<script|<!doctype|<html)", re.I) RE_FSTR = re.compile(r"f[\"']|\.format\(") # 扫描自身代码会自引用误报；排除自带扫描器脚本 SELF_FILES = { "review_checklist.py", "skillsec_audit.py", "studio.py", "upgrade_skill.py", "update_skill.py", "cross_platform_check.py", "dupe_check.py", "maturity_assess.py", "lifecycle_track.py", "roi_filter.py", "evolution_log.py", "training_pack.py", "compose.py", "eval_gen.py", "portal.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The changelog documents a self-update capability that can overwrite files within the skill directory, which is a genuine self-modification risk class even if intentionally designed. The surrounding text shows mitigations exist, but any mechanism that fetches and applies code/content changes remains high impact because compromise of the update source, configuration, or operator judgment could alter trusted skill behavior.
- Content
md - **🟠 合并白名单（新增）**：自更新仅覆盖白名单路径（`SKILL.md`/`references/*`/`scripts/*`/`assets/*` 等），越界文件一律跳过。 - **🟠 触发收窄 + 确认警告（修复，置信度 93–97%）**：自更新默认**仅检查**，`--apply` 才写盘且确认提示明确警告"将覆盖本地技能文件"；自然语言触发词从"升级一下"收敛为"检查/更新本技能"。 - **🟠 缺失警告（修复，置信度 81–97%）**：`portal.py` 生成后提示"产物含技能元数据，外发前请审查"；`update_skill.py` 确认前提示将修改本地文件。 - **🟡 文案精修（低危）**：`framework.md` 模板增加"触发词须具体带边界、写操作须声明需确认"；`SKILL.md` capabilities 补 `ESS_SELF_UPDATE`/`ESS_ALLOWED_REPOS` 治理说明；自更新描述与 README 示例同步收敛。 - **🟢 自我改造（设计内）**：5 条"自我修改"类发现确认属受控治理能力，并补充 SHA256SUMS + 白名单 + 禁用开关三重加固。 - **⚪ 误报澄清**：2 条"未验证输出注入"（studio.py 的 subprocess）经核查仅为打印子脚本输出，未 eval/未进 shell，非注入向量。 - **新增 `SECURITY.md`**：面向企业安全/合规评审，系统说明能力声明、自更新信任模型、合并白名单、企业可落地管控项（禁用开关/仓库白名单/审计日志）、发布侧校验流程，以及第三方扫描发现的处置对照。
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This entry confirms the presence of a self-update mechanism that downloads remote content and can modify the local skill. Even though the changelog describes trust-boundary improvements such as pinned releases, explicit triggers, and no credential access, the core capability still expands attack surface through supply-chain trust and local code replacement.
- Content
md - **供应链·未钉置依赖（修复）**：自更新器 `update_skill.py` 默认从易变的 `main` 分支拉取归档，改为**默认解析最新发布标签（经人工发布、不可变）**作为更新源；新增 `--ref` 可强制钉置到指定标签/提交。未发布 Release 时优雅回退 `main` 并告警，不报错。 - **MCP 最低特权·能力申报不足（修复）**：`SKILL.md` frontmatter 新增显式 `capabilities` 声明（网络 / 文件系统 / 执行 / 特权 / 自治 / 数据处理边界），明确"仅 HTTPS GET 下载、不发送本地数据、不访问凭据、不提权、写操作须用户显式触发"。 - **叛变特工·自我修改（声明）**：`references/self-update.md` 新增「安全审查说明」段，逐条说明自更新为何属受控受治理更新（用户显式触发、硬编码可信源、只复制不执行、路径穿越校验、可回滚），便于安全官审阅采信。 - **数据外流（澄清）**：明确自更新仅向固定仓库发 HTTPS GET 下载，不回传任何本地数据。 - 扫描器其余 11 类（过度能动 / 输出处理 / MCP 工具中毒 / 提示注入 / 特权升级 / 系统提示漏出 / 记忆中毒 / 工具滥用 / 行为 AST-exec-eval / 污染追踪 / YARA）经代码核查均**为误报**：全库无 `exec`/`eval`/动态导入、无 sudo/凭据访问、无隐藏指令或零宽字符，纯文档 + 标准库代码。
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
This section documents the original introduction of a self-update feature, including applying remote updates to the local skill directory. That is a real high-impact capability because successful misuse could replace scripts, references, or metadata and thereby change future agent behavior, even if limited to the skill's own directory.
- Content
md - 支持 `--dry-run`（只预览差异）、`--force`（跨版本也更新）、`--no-backup`、自定义 `--backup-dir`。 - 信任边界：只从固定仓库 `jiwei1122/enterprise-skills-studio` 下载源码，仅覆盖技能自身目录，不改外部配置/凭据。 - 企业内网可 `--repo` 指向私有可信源，实现私有化自更新。 - 新增 `references/self-update.md`：自更新方法论、信任边界、关闭自动拉取的开关说明。 - `scripts/studio.py` 接入 `update` 子命令（`studio update --check` / `studio update --apply`）。 - 新增 `.gitignore`：忽略 `__pycache__` 与更新备份目录。
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The README advertises a self-update capability that can modify the skill from a remote repository. Even with stated safeguards such as pinned releases, checksums, allowlists, and confirmation, self-modifying behavior materially increases supply-chain risk because compromise of the trusted source, release process, or local approval flow could result in untrusted code or instructions being written into the skill.
- Content
md - **可治理、可审计**：版本、弃用、审计、责任归属都有对应工具与文档支撑，符合企业对"可控 AI"的要求。 - **自包含、可移植的知识库**：技能本身即是方法论载体，新窗口、新团队拿来即用，不依赖某次对话的上下文。 - **安全语义层检测**：映射 OWASP AST10，覆盖编码绕过、敏感路径、裸 IP 外联、提权、未声明装包、声明-能力一致性、供应链投毒；并能识别"防御性提及"避免误报安全类技能。 - **自更新（检查 / 确认后升级）**：从钉置到不可变发布标签的可信仓库拉取、SHA256SUMS 校验、合并白名单、增量更新本技能自身，可备份回滚、git 仓库自动保护；企业可经 `ESS_SELF_UPDATE`/`ESS_ALLOWED_REPOS` 管控；内网可指向私有可信源。 - **技能安全审计（SkillSec 16 类）**：借鉴 NVIDIA SkillSpector 公开 16 类漏洞模式（自有开源实现），对任一技能（含本技能自身）做类 SkillSpector 式静态安全审计，输出「类别/严重度/置信度/证据/发现」报告，可作 CI 卡点。 ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This section provides operational details for applying self-updates, including writing files from a remote archive into the local skill directory. The described controls reduce risk, but the core behavior still enables remote-originated modification of local skill content, which is a classic supply-chain and persistence primitive if the trusted repo, checksum source, or approval process is subverted.
- Content
md - **完整性**：归档内含 `SHA256SUMS` 时逐文件校验，不匹配即中止；合并仅接受白名单路径，越界文件跳过。 - **增量合并**：只覆盖/新增远程有的文件，保留你本地额外文件；`--backup` 可更新前快照，随时回滚。 - **安全**：只解包 + 复制，绝不执行远程代码；归档做路径穿越校验，且要求根目录含 `SKILL.md` 才认可；若技能目录本身是 git 仓库则默认保护不误覆盖。 - **企业管控**：设 `ESS_SELF_UPDATE=off` 可禁用写盘更新；设 `ESS_ALLOWED_REPOS="a/b"` 限定可拉取仓库。详见 `SECURITY.md`。 - 企业内网可 fork 到内部仓库，用 `--repo` 指向私有可信源（并加入白名单），实现私有化自更新。 ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The file explicitly documents a self-update capability that can overwrite local skill files, which is a real self-modification risk even if framed as governed and user-triggered. In an agent skill context, any mechanism that fetches remote content and mutates local behavior expands the attack surface for supply-chain compromise, repository redirection mistakes, or abuse of the update path.
- Content
md | 自治（autonomy） | 所有写操作与自更新均须**用户显式触发**（`--apply` 默认交互确认，并明确警告将覆盖本地文件）；不做自主决策。 | | 数据处理（data_handling） | 不采集、不上传、不持久化用户业务数据；分析仅在本机文件内进行。 | ## 2. 自更新（Self-Update）的信任模型 自更新是设计内的受治理能力，采用多层防护：
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This section confirms the presence of runtime controls around self-update, but it also confirms that self-modification remains an exposed feature controlled by environment variables and repository selection. Such controls reduce risk but do not eliminate the core issue that a skill can alter its own files, which is sensitive in enterprise agent environments because misconfiguration or policy bypass could re-enable unsafe update behavior.
- Content
md | 管控项 | 机制 | 作用 | |---|---|---| | **禁用自更新** | 环境变量 `ESS_SELF_UPDATE=off` | 彻底关闭写盘更新（检查仍可用），适合强管控环境。 | | **限定可拉取仓库** | 环境变量 `ESS_ALLOWED_REPOS="a/b,c/d"`（逗号分隔） | 仅允许从这些仓库拉取；未设置则仅允许默认仓库 `jiwei1122/enterprise-skills-studio`。私有化部署时把 `--repo` 指向内部可信源并写入白名单。 | | **审计日志** | 自更新运行会向 stderr 输出动作摘要（下载引用、变更文件数、是否校验通过） | 可重定向到企业日志采集；建议结合 release 流水线统一审计。 |
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 00de27159cd54cfe9be5c776f675aad5d9090680e63b183bddef1d302a24a6ff references/process-systems.md 170a6271344391aebade20e60c65a1cc77aed06229c8bf092a79f54c3f3c76f9 references/roi.md da067cde16f6d84d195072efcafe63a97b669b816b374829415cc60820a3fd86 references/scoping.md f7b5b5ac7932cad56d032cea0bad25f40881b764ab5f861343399bec8ae88994 references/self-update.md f0065a58f96addd5986a00959f0ddd9ae62f6859d0e3e9fcb069f0d21abd31f1 references/skill-spector-method.md 9529f711c6bdced6ee56b7af2b8a78efb8635434d8ad7d1342307aaa685f1ca1 references/training.md 577fc01c827b42ef678167c8cd72b0db126b2d452c97fa87d4d579f7d392fdfe scripts/__pycache__/skillsec_audit.cpython-313.pyc
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
text 00de27159cd54cfe9be5c776f675aad5d9090680e63b183bddef1d302a24a6ff references/process-systems.md 170a6271344391aebade20e60c65a1cc77aed06229c8bf092a79f54c3f3c76f9 references/roi.md da067cde16f6d84d195072efcafe63a97b669b816b374829415cc60820a3fd86 references/scoping.md f7b5b5ac7932cad56d032cea0bad25f40881b764ab5f861343399bec8ae88994 references/self-update.md f0065a58f96addd5986a00959f0ddd9ae62f6859d0e3e9fcb069f0d21abd31f1 references/skill-spector-method.md 9529f711c6bdced6ee56b7af2b8a78efb8635434d8ad7d1342307aaa685f1ca1 references/training.md 577fc01c827b42ef678167c8cd72b0db126b2d452c97fa87d4d579f7d392fdfe scripts/__pycache__/skillsec_audit.cpython-313.pyc
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The SKILL.md advertises a very broad enterprise platform with many security and governance controls, but this file itself only provides descriptive claims rather than verifiable implementation. That mismatch can mislead operators into trusting protections or review capabilities that may not actually exist, causing unsafe deployment assumptions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md agent_created: true capabilities: network: "仅向固定可信源 jiwei1122/enterprise-skills-studio 发起 HTTPS GET 以下载更新归档；不发送任何本地数据，不连接该仓库以外的任何地址" filesystem: "读取/写入严格限制在本技能自身目录；绝不访问 ~/.ssh、.env 或任何凭据文件" execution: "仅运行本技能自带的标准库 Python 脚本；自更新仅复制文件，绝不执行远程下载的代码" privilege: "不使用 sudo/root，不提权，不读取环境变量或系统凭据" autonomy: "所有写操作与自更新均须用户显式触发（--apply 默认交互确认，并明确警告将覆盖本地文件）；不做自主决策；企业可设 ESS_SELF_UPDATE=off 禁用写盘更新、ESS_ALLOWED_REPOS 限定可拉取仓库"
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill explicitly supports self-update and local file modification, which is inherently dangerous even with claimed safeguards. Any mechanism that fetches content from a remote source and rewrites skill files increases supply-chain and integrity risk, especially if the surrounding harness permissions are broad or enforcement of confirmations/pinning is weak.
- Content
md filesystem: "读取/写入严格限制在本技能自身目录；绝不访问 ~/.ssh、.env 或任何凭据文件" execution: "仅运行本技能自带的标准库 Python 脚本；自更新仅复制文件，绝不执行远程下载的代码" privilege: "不使用 sudo/root，不提权，不读取环境变量或系统凭据" autonomy: "所有写操作与自更新均须用户显式触发（--apply 默认交互确认，并明确警告将覆盖本地文件）；不做自主决策；企业可设 ESS_SELF_UPDATE=off 禁用写盘更新、ESS_ALLOWED_REPOS 限定可拉取仓库" data_handling: "不采集、不上传、不持久化用户业务数据；分析仅在本机文件内进行" ---
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 、提权、未声明装包、声明-能力一致性；仅扫可执行文件，借鉴 `skill-scanner`(朱雀 A.I.G) 与 `skill-vetter` 规则），跑 `scripts/review_checklist.py`，结合 `references/governance.md` + `references/princip
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The repeated self-update declaration reflects a real self-modification capability rather than a harmless description. In the context of an enterprise-oriented skill that may be trusted for governance and security review, self-modification is more dangerous because users may over-trust the updater and allow persistent tampering of the very tool responsible for oversight.
- Content
md 20. **成本/计量追踪** — 半自动 usage 日志采集 token/调用/成本，外推月用量直接喂给 ROI 判定，给 sponsor 算账（`scripts/usage_tracker.py` + `references/roi.md` 闭环） 21. **技能门户生成器** — 技能库 → 门户目录/README/HTML，提升可发现性与治理可视化，可结合 lifecycle 注册表标注状态（`scripts/portal.py`） 22. **发布前卡点（gate）** — 一键同时跑【安全体检 + 移植体检】，任一 BLOCK 即整体 BLOCK，发布/移植前必过（`scripts/studio.py gate --skill <dir> [--platform codex]`） 23. **自更新（Self-Update）** — 说"检查/更新本技能"即检查并（确认后）应用自身最新版本：从钉置到不可变发布标签的可信仓库拉取归档、SHA256SUMS 完整性校验、合并白名单、可备份回滚、git 仓库自动保护、非默认仓库强制确认（`scripts/update_skill.py` + `references/self-update.md`，默认 `studio update` 仅检查，需 `--apply` 并经确认才写盘） 24. **技能安全审计（SkillSec 16 类）** — 对任一技能（含本技能自身）做类 NVIDIA SkillSpector 式静态安全审计：覆盖过度能动/输出处理/叛变特工/触发滥用/MCP 最低特权/MCP 工具中毒/提示注入/数据外流/特权升级/供应链/系统提示漏出/记忆中毒/工具滥用/危险 AST/污染追踪/YARA 签名 16 类，输出「类别/严重度/置信度/证据/发现」报告，可作 CI 卡点（`scripts/skillsec_audit.py` + `references/skill-spector-method.md`，`studio audit <skill> [--json|--md]`；方法论借鉴 SkillSpector 公开分类，本实现为自有开源代码） > 增强项（扩展既有模式）：成熟度模型新增 **Agentic 维度**（模式 8 / `scripts/maturity_assess.py`，向后兼容）；审查器新增 **AI 安全维度** PII/凭据/外部输入校验（模式 5 / `scripts/review_checklist.py`）；审查器再新增 **安全语义层维度**（模式 5 / `scripts/review_checklist.py`，借鉴腾讯朱雀 `skill-scanner` 的编码绕过/零宽走私检测 + `skill-vetter` 的敏感路径/裸IP/提权/未声明装包/声明-能力一致性红标清单）；新增 **技能安全审计能力**（模式 24 / `scripts/skillsec_audit.py`，方法论借鉴 NVIDIA SkillSpector 公开 16 类漏洞模式，自有开源实现，与 `review` 体检互补）。
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The repeated self-update declaration reflects a real self-modification capability rather than a harmless description. In the context of an enterprise-oriented skill that may be trusted for governance and security review, self-modification is more dangerous because users may over-trust the updater and allow persistent tampering of the very tool responsible for oversight.
- Content
md 20. **成本/计量追踪** — 半自动 usage 日志采集 token/调用/成本，外推月用量直接喂给 ROI 判定，给 sponsor 算账（`scripts/usage_tracker.py` + `references/roi.md` 闭环） 21. **技能门户生成器** — 技能库 → 门户目录/README/HTML，提升可发现性与治理可视化，可结合 lifecycle 注册表标注状态（`scripts/portal.py`） 22. **发布前卡点（gate）** — 一键同时跑【安全体检 + 移植体检】，任一 BLOCK 即整体 BLOCK，发布/移植前必过（`scripts/studio.py gate --skill <dir> [--platform codex]`） 23. **自更新（Self-Update）** — 说"检查/更新本技能"即检查并（确认后）应用自身最新版本：从钉置到不可变发布标签的可信仓库拉取归档、SHA256SUMS 完整性校验、合并白名单、可备份回滚、git 仓库自动保护、非默认仓库强制确认（`scripts/update_skill.py` + `references/self-update.md`，默认 `studio update` 仅检查，需 `--apply` 并经确认才写盘） 24. **技能安全审计（SkillSec 16 类）** — 对任一技能（含本技能自身）做类 NVIDIA SkillSpector 式静态安全审计：覆盖过度能动/输出处理/叛变特工/触发滥用/MCP 最低特权/MCP 工具中毒/提示注入/数据外流/特权升级/供应链/系统提示漏出/记忆中毒/工具滥用/危险 AST/污染追踪/YARA 签名 16 类，输出「类别/严重度/置信度/证据/发现」报告，可作 CI 卡点（`scripts/skillsec_audit.py` + `references/skill-spector-method.md`，`studio audit <skill> [--json|--md]`；方法论借鉴 SkillSpector 公开分类，本实现为自有开源代码） > 增强项（扩展既有模式）：成熟度模型新增 **Agentic 维度**（模式 8 / `scripts/maturity_assess.py`，向后兼容）；审查器新增 **AI 安全维度** PII/凭据/外部输入校验（模式 5 / `scripts/review_checklist.py`）；审查器再新增 **安全语义层维度**（模式 5 / `scripts/review_checklist.py`，借鉴腾讯朱雀 `skill-scanner` 的编码绕过/零宽走私检测 + `skill-vetter` 的敏感路径/裸IP/提权/未声明装包/声明-能力一致性红标清单）；新增 **技能安全审计能力**（模式 24 / `scripts/skillsec_audit.py`，方法论借鉴 NVIDIA SkillSpector 公开 16 类漏洞模式，自有开源实现，与 `review` 体检互补）。
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
text --- name: {skill-name} # ≤64字符，小写/数字/连字符，见名知意 description: {功能一句话}；当用户{description写清触发时机}时使用。 # ≤1024字符，必须含"何时调用" agent_created: true --- # {技能标题} {一句话说明这个技能解决什么、服务谁。} <!-- 厚技能+薄harness 提示： - 把确定性步骤写成 scripts/ 脚本，跑脚本返回结果，而非让模型每次重写代码 - 关键输出用模板/schema 约束；给足 应触发/不应触发/边界 示例 - 把校验、决策树、自检逻辑固化进技能；harness 只需"调用" --> ## 指令层（语气 / 格式 / 决策优先级
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text {一句话说明这个技能解决什么、服务谁。} <!-- 厚技能+薄harness 提示： - 把确定性步骤写成 scripts/ 脚本，跑脚本返回结果，而非让模型每次重写代码 - 关键输出用模板/schema 约束；给足 应触发/不应触发/边界 示例
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text {一句话说明这个技能解决什么、服务谁。} <!-- 厚技能+薄harness 提示: - 把确定性步骤写成 scripts/ 脚本,跑脚本返回结果,而非让模型每次重写代码 - 关键输出用模板/schema 约束;给足 应触发/不应触发/边界 示例
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 1 | 无治理的技能蔓延（Sprawl） | 静默安装、无中央注册表、无 SIEM 事件 | AST09 | | 2 | 供应链投毒 | 开放注册、零审查、无签名；克隆即触发执行/凭据外泄 | AST01/02 | | 3 | 过度授权执行 | skill 继承代理全部运行时权限，无 per-skill 边界（"同意缺口"） | AST03/06 | | 4 | 隐形载荷：Markdown 即攻击向量 | 自然语言指令即可外泄 `~/.ssh/id_rsa`；动态上下文命令加载即执行绕过安全推理 | AST04/08 | | 5 | 跨平台可移植性 | SKILL.md 跨平台传播，安全元数据丢失，恶意更新静默扩散 | AST10 | 防护要点：技能库存（inventory）是一切控制前提；per-skill 最小权限；不可信源不装；版本 pin + 签名溯源。