Skillhub

• Outcome: Review
• Latest audit: Sep 18, 2026 · 6:09 PM UTC
• Version: 0.1.0

Overview

The skill is a plausible SkillHub helper, but its batch workflow can publicly publish local skill folders to GitHub and its install instructions include an overbroad forced delete command.

Install only if you want an agent to automate SkillHub publishing and, when using batch_release.py, potentially create public GitHub repositories from local skill folders. Use dry-run first, pass --stage publish when you do not want GitHub sync, inspect and trust ~/.workbuddy/tools/push_via_api.py before using it, and manually verify or back up the skills directory before running the documented Move-Item/Remove-Item flattening commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The manifest claims a constrained SkillHub search/install/publish/status purpose, but the documented behavior extends into local Git repository management, public GitHub repository creation, committing, pushing, and batch-release orchestration. This mismatch can mislead users and calling systems about the real side effects, causing them to authorize a skill that performs broader external publication and local state changes than expected.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The manifest claims a constrained SkillHub search/install/publish/status purpose, but the documented behavior extends into local Git repository management, public GitHub repository creation, committing, pushing, and batch-release orchestration. This mismatch can mislead users and calling systems about the real side effects, causing them to authorize a skill that performs broader external publication and local state changes than expected.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/skillhub_publish.py (reported line 164)May include surrounding context.

python

`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/skillhub_publish.py (reported line 306)May include surrounding context.

python

`~/.local/bin/skillhub.cmd`（cmd/PS）、`skillhub`（Git Bash）
- **Python**：默认系统 `python.exe`（managed 3.13 跑网络请求会 segfault）；
  覆盖用环境变量 `SKILLHUB_PYTHON`。
- **登录**（仅发布需要）：`skillhub login --key skh_xxx`，token 落 `~/.skillhub/credentials.json`。
  不确定就跑 `doctor` 自检四项。
- 搜索 / 安装 / 查状态**无需登录**；发布要联网并过平台三线审核。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md

- **技能自我覆盖**：脚本从远端下整包、原地覆盖自己的 `SKILL.md` 与脚本，且摘要校验形同虚设

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/batch_release.py (reported line 187)May include surrounding context.

python

def cli_env():
    """skillhub CLI 在 Git Bash 下会 RuntimeError: Could not determine home directory，
    显式给 HOME / USERPROFILE 即可。"""
    env = dict(os.environ)
    env["HOME"] = str(HOME)
    env["USERPROFILE"] = str(HOME)
    env["PYTHONIOENCODING"] = "utf-8"

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/skillhub_publish.py (reported line 137)May include surrounding context.

python

def cli_env():
    """skillhub CLI 在 Git Bash 下会 RuntimeError: Could not determine home directory，
    显式给 HOME / USERPROFILE 即可。"""
    env = dict(os.environ)
    env["HOME"] = str(HOME)
    env["USERPROFILE"] = str(HOME)
    env["PYTHONIOENCODING"] = "utf-8"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and relies on powerful capabilities including shell execution, filesystem access, environment inspection, network access, and file modification, yet it declares no explicit tool scope or permissions boundary in the manifest. This increases the chance of over-privileged execution, accidental misuse, or silent expansion of what the agent may do on a user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language invocation examples include ambiguous everyday phrases like re-release or publish that are not tightly scoped to SkillHub. In an automated routing context, that ambiguity can dispatch this skill for unrelated release tasks, exposing the user to shell, file, and network side effects outside the intended context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes broad phrases related to release, publishing, and store actions that may match common user intents beyond this specific skill. Over-broad activation can cause an agent to invoke a high-privilege skill unexpectedly, leading to unintended installation, file modification, publication, or network operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's declared business purpose centers on SkillHub store operations, but the documentation introduces GitHub repository creation/synchronization and batch orchestration as additional behaviors. Hidden or under-disclosed secondary functions are risky because they can exfiltrate code to third-party services or alter repository state under a narrower trust model than users intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

GitHub API interaction is a materially different capability from SkillHub search/install/status and expands data flow to another external platform. If not clearly justified and scoped, it can publish local code, metadata, or repository history to GitHub when the user only expected SkillHub store operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and entire document content are written in Chinese, with no indication that language selection is optional or that the file is intended only for a China-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The statement SkillHub 是国内优先的技能源，比公共 registry 更快、更合规 expresses a locale-specific preference as normative guidance, steering users toward a domestic source by default. The file does not present this as an optional choice or justify it as a region-specific compliance requirement for a defined audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document includes PowerShell commands that forcibly move and recursively delete directories (Move-Item ... -Force, Remove-Item ... -Recurse -Force) in a user skill directory, but it does not give an explicit warning about possible data loss or the need to verify paths before execution. In a skill-installation context, users may copy-paste these commands directly; if variables are wrong or the directory structure differs, this can delete unintended content or disrupt installed skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring presents all user-facing usage instructions, options, and exit-code descriptions only in Chinese. For a generally applicable release automation script, this is a language-policy concern because it imposes a specific language on users without any documented opt-in or alternative locale.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_release.py (reported line 40)May include surrounding context.

python

def run(cmd, cwd=None, env=None):
    r = subprocess.run(cmd, cwd=cwd, env=env, capture_output=True, text=True,
                       encoding="utf-8", errors="replace")
    return r.returncode, ((r.stdout or "") + (r.stderr or "")).strip()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/platform-fields.md (reported line 78)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 47)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 51)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 54)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 57)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 71)May include surrounding context.

md

sys.dont_write_bytecode = True

API = "https://api.skillhub.cn/api/v1"
HOME = Path(os.path.expanduser("~"))

# ── 平台 13 个分类枚举（实测） ──────────────────────────────────────────────