Security audit

Skill Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This is a local skill-quality checker with no network, persistence, or hidden destructive behavior, though it asks for broader tool access than its scripts currently need.

Install only if you want a Chinese-language local skill audit helper. Prefer removing or withholding Write permission unless you explicitly ask the agent to edit a skill, and run the scripts only against skill folders you intend to inspect. The missing referenced docs reduce completeness but do not by themselves indicate malicious behavior.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:10
Finding: Skill Declares Excessive Tool Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/optimize-skill.py:291
Finding: Untrusted Skill Data Is Printed Without Terminal-Control Sanitization
Content: View full analysis
50 else check['value']}") ``` From `scripts/check-templates.py`: ```python print(f"状态：{result['status']}") print(f"\n提到的文件 ({len(result['mentioned'])}个):") for f in result['mentioned']: if f in result['found']: print(f" {Colors.GREEN}✅{Colors.RESET} {f}") else: print(f" {Colors.RED}❌{Colors.RESET} {f} (缺失)") ``` ### Technical Analysis Skill names, metadata values, and referenced filenames originate from audited files or directory names and are rendered directly to a terminal. The code does not remove ANSI escape sequences or other C0/C1 control characters before printing these values. An attacker can embed terminal control sequences in a Skill directory name or metadata value. When a reviewer runs the audit in a compatible terminal, those sequences may clear or rewrite displayed output, alter colors, reposition the cursor, forge apparent success messages, or manipulate terminal presentation. This is an output-integrity issue. The reviewed code does not demonstrate that terminal sequences can directly execute shell commands. ### Attack Path 1. An attacker creates a Skill with a crafted directory name or frontmatter value containing terminal escape characters. 2. A reviewer invokes `optimize-skill.py` or `check-templates.py` against the crafted Skill. 3. The script reads the attacker-controlled value without validation. 4. The value is interpolated directly into a `print()` call. 5. The terminal interprets embedded control sequences rather than displayin ...[truncated 577 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description suggests a broad 'skill quality' or 'skill evaluation' capability, including checking and optimization contexts. However, the supplied code only validates whether certain file paths mentioned in SKILL.md exist. It does not assess overall skill quality, optimization, correctness, triggers, permissions, or other validation dimensions. While batch checking is supported, it is limited to template/reference/script file existence. Therefore the description materially overstates the primary purpose of the code, making this a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
md
- `scripts/optimize-skill.py` - 评估脚本

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description contains broad phrases like checking or optimizing a skill, which can cause the agent to activate in contexts beyond the author's intent. In a skill with Bash/Exec/Write permissions, unintended activation increases the chance of unnecessary filesystem inspection or tool execution on unrelated content, expanding the attack surface and enabling prompt-routing abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring is written entirely in Chinese and establishes the skill's description and behavior in a single language. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is a code file, so natural-language policy checks apply to its docstrings and printed strings. The file presents its purpose, usage, and later console messages entirely in Chinese without offering a language selection or documenting a justified locale restriction, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.