Security audit

cjpkg

Security checks for vulnerabilities and agentic risk

Overview

This Cangjie package helper is mostly related to package management, but it gives agents broad permission to change projects and persistent shell settings without enough scoping or rollback guidance.

Install only if you want an agent to help manage Cangjie packages, not just search for them. Before using setup or configuration steps, require the agent to show exact commands and diffs, back up cjpm.toml and shell profile files, and avoid persistent PATH or shell changes unless you explicitly approve them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares itself as a package-discovery helper, but its instructions clearly enable network access and local file modification without declaring those capabilities. This creates a trust and review gap: a user or orchestrator may invoke the skill expecting read-only discovery behavior while it can download artifacts and alter project files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior significantly exceeds the declared purpose: beyond discovery, it downloads packages, writes into local directories, edits cjpm.toml, and configures projects. That mismatch is dangerous because users and policy systems may authorize the skill under a low-risk description while it performs materially riskier actions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill suffers from scope drift: a repository-discovery tool is expanded into SDK installation, shell/profile modification, project initialization, dependency editing, building, and package publishing. This increases attack surface and the likelihood of unintended system or workspace changes far beyond what a user would reasonably infer from the manifest.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs modifying shell startup files and PATH/environment settings, including appending to .zshrc and sourcing it. Persistent environment changes are sensitive because they alter future shell behavior, can break developer environments, and are disproportionate to a package-discovery task.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill directs editing project configuration files, initializing projects, and building user code. These are state-changing operations on arbitrary local paths and can damage projects, introduce unreviewed dependencies, or trigger build-time execution in a user workspace.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is presented as a package discovery/download utility, but it also exposes arbitrary local TOML read and write operations through `-g/--get` and `-e/--set`. In an agent context, this creates a capability mismatch that can be abused to inspect or alter local configuration files, secrets, or project manifests unrelated to package lookup, which is far more dangerous than the advertised purpose suggests.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module docstring claims the tool only searches or downloads packages, while the implementation also reads and modifies TOML files. This misleading description can cause operators or orchestration systems to grant trust or invoke the skill under false assumptions, increasing the chance that file-system access is used unexpectedly.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation guidance is broad enough to match many common requests, increasing the chance this skill is invoked in situations where the user did not ask for package discovery or project changes. Because the skill also contains state-changing instructions, overbroad triggering makes accidental misuse more dangerous.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'When to Use This Skill' conditions are ambiguous and broad, covering generic development help and domain assistance rather than narrowly scoped registry/package discovery. In context, this expands exposure to the skill's risky instructions for downloading, configuration, and build actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown includes commands that persistently modify startup files and environment settings without prominent warnings, rollback steps, or least-privilege alternatives. Even if intended to help, these commands can surprise users, break shell configuration, or create unsafe habits around executing profile-modification commands.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code overwrites the specified TOML file immediately with `open(path, "w")` after parsing user input, without any confirmation, backup, dry-run mode, or path restrictions. In an agent-driven workflow, a malformed prompt or malicious instruction could silently alter important configuration files, causing denial of service, dependency changes, or persistence of attacker-controlled settings.

Static analysis

No suspicious patterns detected.