可以登錄家電的保固，並且歸檔，提供查詢

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:25 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed toolkit for creating, validating, and packaging Codex skills, with no evidence of hidden network access, credential theft, persistence, or destructive behavior.

Install this only if you want Codex to help author or update skills. Because it can create executable scripts and SKILL.md files that influence future agent behavior, use clear target directories, review generated diffs before installing created skills, and avoid broad trigger descriptions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description is broader and centers on creating or updating AgentSkills, implying modification or authoring of skill contents. The supplied code chunk only packages an already-existing skill directory into a .skill archive after checking that the folder exists, contains SKILL.md, and passes validation. While packaging is mentioned in the description, the create/update functionality is not present in this code. This makes the actual behavior materially narrower and somewhat different from the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description centers on creating or updating AgentSkills, which implies generation or modification workflows. The supplied code instead performs read-only validation of an existing skill's SKILL.md frontmatter and exits with success/failure. While validation could be a supporting function in a broader skill-authoring toolchain, this code chunk's primary purpose is materially different from the declared purpose because it neither creates nor updates skills, nor handles packaging of scripts, references, or assets. Therefore this is a description-to-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description says the skill is for creating or updating AgentSkills and packaging their contents. However, the supplied code chunk is not implementing packaging functionality itself; it is a Python unit/regression test module that validates another module’s packaging security behavior. Its primary purpose is QA/security testing, not designing, structuring, or packaging skills for user use. While the tests are related to packaging, the actual behavior is materially different from the declared operational purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description suggests a skill whose primary function is to create or update AgentSkills. However, the supplied code does not implement skill creation, editing, structuring, or packaging behavior. Instead, it is a test module focused on validating the behavior of a separate quick validation component. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Self-Modification

High

• Category: Rogue Agent

Content

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

• Confidence: 88% confidence
• Finding: This skill explicitly directs the agent to create and edit skill resources, including `SKILL.md`, scripts, references, and assets. Self-modifying or skill-authoring behavior is high risk because it can alter future agent behavior, persistence, or available tooling, especially when combined with shell and file-write capabilities.

Self-Modification

High

• Category: Rogue Agent

Content

If you used `--examples`, delete any placeholder files that are not needed for the skill. Only create resource directories that are actually required.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

• Confidence: 89% confidence
• Finding: The instruction to update `SKILL.md` reinforces that this skill can rewrite agent guidance and trigger metadata, which can materially change how the system behaves later. In the skill context, modifying agent instructions is more dangerous than ordinary document editing because it affects future activations and potentially expands behavior indirectly.

Self-Modification

High

• Category: Rogue Agent

Content

# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print("2. Customize or delete the example files in scripts/, references/, and assets/")

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and write files, run shell commands, and potentially access bundled resources, but it declares no explicit tool scope or permission boundary. That creates unnecessary ambient authority: if this skill is triggered in an unexpected context, the agent may perform filesystem or shell actions the user did not clearly intend.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The guidance says the description is the primary triggering mechanism and encourages including 'all when to use information' comprehensively. Overly broad trigger metadata can cause accidental activation of a powerful skill, increasing the chance that file-writing, shell-executing, or packaging behavior is invoked in unrelated tasks.

Static analysis

No suspicious patterns detected.