Privacy Scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:51 AM UTC
• Version: 1.1.0

Overview

This privacy-scanning skill does what it says, but it may reveal the secrets it finds in its scan output.

Review before installing or running in shared terminals, CI, or agent environments. Use it only on intended project directories, avoid uploading scan logs, and prefer a version that redacts matched secret values while reporting only file paths, line numbers, and finding types.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/privacy-scan.sh:92

Finding

Unredacted Sensitive Values Are Printed to Scan Output

Content

View full analysis

/dev/null | head -5 || true) echo "$results" ``` A representative caller subsequently prints the complete matching lines: ```bash if [ -n "$results" ]; then fail "发现疑似真实 Webhook URL:" echo "$results" | while IFS= read -r line; do echo " $line"; done else pass "无真实 Webhook URL" fi ``` The same output pattern is used across checks for API keys, bearer tokens, passwords, JWTs, database connection strings, webhooks, and private-key content. ### Technical Analysis The scanner invokes `grep -rn`, which returns the file path, line number, and complete text of every matching line. Those results are emitted verbatim to standard output. Because the patterns are specifically designed to locate secrets, the displayed line can contain the complete secret rather than merely identifying its location. Output may consequently be retained in CI logs, terminal recordings, Agent transcripts, build artifacts, or centralized log aggregation systems. This expands access to a secret beyond the users and processes that could read the original file. A privacy scanner only needs to identify the affected file, line number, and secret type. Printing the underlying value is unnecessary for the declared functionality. ### Attack Path 1. A scanned repository contains a real API token, password, webhook URL, JWT, database credential, or other supported secret. 2. A user or automated pipeline runs `privacy-scan.sh` against that repository. 3. `grep -rn` captures the complete line containing the secret. 4. The scrip ...[truncated 1207 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

| 6 | 内网 IP | `192.168.x.x`, `10.x.x.x` | ⚠️ 警告 |
| 7 | 邮箱地址 | `[e-mail]` | ⚠️ 警告 |
| 8 | 手机号 | 中国大陆 11 位 | ❌ 失败 |
| 9 | 敏感文件 | `.env`, `credentials.json`, 私钥 | ❌ 失败 |
| 10 | 密码/Secret | `password="xxx"`, `secret="xxx"` | ❌ 失败 |
| 11 | Discord Webhook | `discord.com/api/webhooks/` | ❌ 失败 |
| 12 | Slack Webhook | `hooks.slack.com/services/` | ❌ 失败 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

| 6 | 内网 IP | `192.168.x.x`, `10.x.x.x` | ⚠️ 警告 |
| 7 | 邮箱地址 | `[e-mail]` | ⚠️ 警告 |
| 8 | 手机号 | 中国大陆 11 位 | ❌ 失败 |
| 9 | 敏感文件 | `.env`, `credentials.json`, 私钥 | ❌ 失败 |
| 10 | 密码/Secret | `password="xxx"`, `secret="xxx"` | ❌ 失败 |
| 11 | Discord Webhook | `discord.com/api/webhooks/` | ❌ 失败 |
| 12 | Slack Webhook | `hooks.slack.com/services/` | ❌ 失败 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/privacy-scan.sh (reported line 208)May include surrounding context.

sh

| 6 | 内网 IP | `192.168.x.x`, `10.x.x.x` | ⚠️ 警告 |
| 7 | 邮箱地址 | `[e-mail]` | ⚠️ 警告 |
| 8 | 手机号 | 中国大陆 11 位 | ❌ 失败 |
| 9 | 敏感文件 | `.env`, `credentials.json`, 私钥 | ❌ 失败 |
| 10 | 密码/Secret | `password="xxx"`, `secret="xxx"` | ❌ 失败 |
| 11 | Discord Webhook | `discord.com/api/webhooks/` | ❌ 失败 |
| 12 | Slack Webhook | `hooks.slack.com/services/` | ❌ 失败 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/privacy-scan.sh (reported line 208)May include surrounding context.

sh

# 9. 敏感文件
print_header "9. 敏感文件"
sensitive_found=false
for file in ".env" "credentials.json" "secrets.json" "id_rsa" "id_ed25519" ".pem" ".key" ".p12" ".pfx"; do
    matches=$(find "$SCAN_DIR" -name "*$file*" -not -path "*/node_modules/*" -not -path "*/.git/*" 2>/dev/null || true)
    if [ -n "$matches" ]; then
        fail "发现敏感文件: $file"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/privacy-scan.sh (reported line 208)May include surrounding context.

sh

# 9. 敏感文件
print_header "9. 敏感文件"
sensitive_found=false
for file in ".env" "credentials.json" "secrets.json" "id_rsa" "id_ed25519" ".pem" ".key" ".p12" ".pfx"; do
    matches=$(find "$SCAN_DIR" -name "*$file*" -not -path "*/node_modules/*" -not -path "*/.git/*" 2>/dev/null || true)
    if [ -n "$matches" ]; then
        fail "发现敏感文件: $file"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill description and operating instructions are written in Chinese, including required publishing steps, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description is broad enough that the skill may activate on common terms like “publish” or generic privacy-check phrases, causing it to run in situations the user did not clearly intend. Over-broad invocation increases the chance of scanning unintended directories or files, which can expose local metadata or create unnecessary access to sensitive content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill metadata and content are written entirely in Chinese and appear to prescribe that locale without stating any user-choice behavior. This can lead to misunderstandings of warnings, consent, or scan results for users expecting another language, which is a safety and usability issue in a tool handling sensitive data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script presents its help text, status messages, warnings, and results in Chinese only, including the usage output and all scan findings. That creates a language/locale policy issue because the skill forces a specific language for all users without opt-in or justification for a region-specific audience.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/privacy-scan.sh (reported line 98)May include surrounding context.

sh

local results
    if [ -n "$exclude_placeholder" ]; then
        results=$(grep -rn --include="*.sh" --include="*.md" --include="*.json" --include="*.yaml" --include="*.yml" --include="*.ts" --include="*.js" --include="*.plist" \
            "$pattern" "$SCAN_DIR" 2>/dev/null | grep -v "$exclude_placeholder" | head -5 || true)
    else
        results=$(grep -rn --include="*.sh" --include="*.md" --include="*.json" --include="*.yaml" --include="*.yml" --include="*.ts" --include="*.js" --include="*.plist" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/privacy-scan.sh (reported line 101)May include surrounding context.

sh

local results
    if [ -n "$exclude_placeholder" ]; then
        results=$(grep -rn --include="*.sh" --include="*.md" --include="*.json" --include="*.yaml" --include="*.yml" --include="*.ts" --include="*.js" --include="*.plist" \
            "$pattern" "$SCAN_DIR" 2>/dev/null | grep -v "$exclude_placeholder" | head -5 || true)
    else
        results=$(grep -rn --include="*.sh" --include="*.md" --include="*.json" --include="*.yaml" --include="*.yml" --include="*.ts" --include="*.js" --include="*.plist" \