Skill Validator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 1.0.11

Overview

This skill is presented as a validator, but its instructions also push users toward unpinned remote publishing scripts and higher-impact publish workflows.

Review before installing. Use only the bundled validator scripts if you want local checks. Avoid the documented curl-and-run adapter flow unless you pin the source to a reviewed commit and verify a checksum, and do not use the publish or CI examples unless you intentionally want remote publishing with the relevant credentials exposed to that job. Avoid install.sh --link unless you are comfortable creating or replacing global commands under /usr/local/bin.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:78

Finding

Unpinned Remote Shell Script Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78-79 and 290-291
Vulnerability Type: Remote payload retrieval through a mutable external source
Risk Level: High

Vulnerable Code

Lines 78-79:

bash

curl -sSL https://raw.githubusercontent.com/puppetcat-fire/skill-publish-adapter/main/skill-publish-adapter.sh -o skill-publish-adapter.sh
chmod +x skill-publish-adapter.sh

Lines 290-291:

bash

curl -sSL https://raw.githubusercontent.com/puppetcat-fire/skill-publish-adapter/main/skill-publish-adapter.sh -o adapter.sh
chmod +x adapter.sh

The documentation subsequently instructs users and CI jobs to execute the downloaded script, including commands such as:

bash

./skill-publish-adapter.sh validate ./my-skill

and:

bash

./adapter.sh publish . \
  --slug ${{ github.event.repository.name }} \
  --name "${{ github.event.repository.name }}" \
  --version ${GITHUB_REF#refs/tags/v}

Technical Analysis

The installation instructions download a shell script from the mutable main branch of a personal GitHub repository. The command follows redirects and neither pins the content to an immutable commit nor verifies a checksum or cryptographic signature. Marking the result executable and subsequently invoking it creates a remote code-execution channel whose effective payload may change after this skill has been reviewed.

The downloaded adapter is not included in the audited project, so its behavior cannot be verified from the supplied artifact. It is also not required for the local validation operations implemented by the packaged skill-validator*.sh files. Directing users to this external component therefore expands the trust boundary beyond the minimum needed for the declared validation functionality.

This finding establishes a supply-chain and remote-payload risk. It does not establish that the currently hosted external script is malicious.

Attack Path

1. An attacker compromises the upstream repository, it ...[truncated 1255 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the reviewed adapter within the skill package so its contents are covered by the same audit and release process.
2. If remote retrieval is unavoidable, use a URL pinned to an immutable commit rather than the mutable main branch.
3. Publish a trusted SHA-256 digest through an independent, authenticated release channel and verify it before granting execution permission:

bash

curl --fail --show-error --location \
  "https://raw.githubusercontent.com/puppetcat-fire/skill-publish-adapter/COMMIT_HASH/skill-publish-adapter.sh" \
  --output skill-publish-adapter.sh

echo "EXPECTED_SHA256  skill-publish-adapter.sh" | sha256sum --check --strict -
chmod 0755 skill-publish-adapter.sh

4. Prefer cryptographically signed release artifacts and verify the signature against a documented maintainer key.
5. Configure CI jobs with least-privilege tokens, avoid exposing unrelated secrets, and restrict network and filesystem permissions where practical.
6. Fail closed on download or verification errors. Avoid silent operation and explicitly constrain redirect behavior to trusted destinations.
7. Clearly disclose that the adapter is an external executable with a separate trust boundary and security review lifecycle.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose promises comprehensive spec synchronization and repair guidance, but the documented behavior does not substantiate that claim and instead focuses on narrower script checks and publishing workflows. Overclaiming safety and coverage can cause users to trust the tool for compliance decisions it is not actually equipped to make.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose promises comprehensive spec synchronization and repair guidance, but the documented behavior does not substantiate that claim and instead focuses on narrower script checks and publishing workflows. Overclaiming safety and coverage can cause users to trust the tool for compliance decisions it is not actually equipped to make.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest presents a validator, while the documentation describes publish-adapter behavior including release workflows and bug bypasses. This is a classic scope-deception issue: the declared identity lowers suspicion, but the documented operations expand into deployment and network-sensitive actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The title and body directly contradict the manifest by documenting a different tool, 'skill-publish-adapter'. Such inconsistency can conceal the true operational scope from users, reviewers, and automated policy systems, increasing the chance of unintended execution of riskier actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented capabilities include automatic bug bypass and multi-channel publishing, which exceed a validation tool's stated purpose. In context, this is more dangerous because the skill is framed as routine quality checking, yet it normalizes deployment actions that can affect remote services and project state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The primary documented commands are for a publish adapter, including fix and publish operations, rather than a standalone validator. This expands from read-only inspection into modification and deployment, creating a materially different risk profile than the manifest suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bug-bypass and multi-method publish logic adds deployment and workflow-circumvention capabilities not justified by the stated validation purpose. Bypass-oriented language is especially concerning because it encourages evasion of platform safeguards and retries potentially sensitive operations automatically.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

if [ ! -f "SKILL.md" ]; then

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Examples and workflows repeatedly direct users to publish skills to platforms, exceeding the manifest's validation-and-repair scope. Concrete examples strongly shape agent behavior, so these snippets materially increase the chance the skill will be used for unintended remote actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 78)May include surrounding context.

sh

cat > "$RULES_DIR/security-rules.json" << 'EOF'
{
  "dangerous_patterns": [
    "rm -rf /",
    "chmod 777",
    "password.*=",
    "api_key.*=",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 78)May include surrounding context.

sh

cat > "$RULES_DIR/security-rules.json" << 'EOF'
{
  "dangerous_patterns": [
    "rm -rf /",
    "chmod 777",
    "password.*=",
    "api_key.*=",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 79)May include surrounding context.

sh

{
  "dangerous_patterns": [
    "rm -rf /",
    "chmod 777",
    "password.*=",
    "api_key.*=",
    "secret.*=",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and documents shell-based actions but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens containment and user expectations, making it easier for an agent to invoke shell capabilities without a clearly bounded contract.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example trigger phrases are broad and generic, making accidental invocation more likely. In this case that matters because the skill's actual documented scope includes file changes and publishing behavior, so mistaken activation could lead to more than passive validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description mentions automatic repair but does not clearly warn that files may be modified or that commands could be destructive. Users expecting a validator may not realize the skill can change permissions, create files, or alter project state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description omits an explicit privacy/network warning despite documenting remote downloads and publication actions. This creates a transparency failure where users may unknowingly permit transfers of code, metadata, or credentials to external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs downloading external scripts and using GitHub-based publishing even though the declared purpose is mere format validation. This introduces unnecessary supply-chain and data-exfiltration risk, especially because users may not expect network retrieval or publication from a validator.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

常见问题

1. "jq命令未找到"

   bash

   sudo apt-get install jq  # Ubuntu/Debian
   brew install jq          # macOS
   

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and user-visible output are written in Chinese throughout, with no option to select another language or indication that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when users are not given an explicit opt-in or locale-specific justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 15)May include surrounding context.

sh

for cmd in bash jq find grep sed; do
    if ! command -v $cmd &> /dev/null; then
        echo "❌ 缺少依赖: $cmd"
        echo "   请安装: sudo apt-get install $cmd  # Debian/Ubuntu"
        exit 1
    fi
done

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script can modify /usr/local/bin via sudo when run with --link, creating or overwriting global command names. While this is presented as optional installation behavior, it performs privileged system-wide changes without an explicit warning, confirmation prompt, or post-check for what will be replaced, which can surprise users and affect other tooling.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This line invokes sudo ln -sf to create or overwrite a global symlink in /usr/local/bin. Because -f forcefully replaces existing targets, a user running the installer can unintentionally alter system command resolution, and the script suppresses errors, reducing transparency.

Content

Scanner excerpt · install.sh (reported line 40)May include surrounding context.

sh

# 创建符号链接（可选）
if [ "$1" = "--link" ]; then
    echo "🔗 创建全局符号链接..."
    sudo ln -sf "$SCRIPT_DIR/skill-validator.sh" /usr/local/bin/skill-validator 2>/dev/null || true
    sudo ln -sf "$SCRIPT_DIR/skill-validator.sh" /usr/local/bin/validate-skill 2>/dev/null || true
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This second sudo ln -sf call creates another privileged global alias, validate-skill, with the same overwrite behavior and hidden errors. The main risk is unannounced system-wide modification rather than code execution by itself, but it can interfere with existing binaries or scripts of the same name.

Content

Scanner excerpt · install.sh (reported line 41)May include surrounding context.

sh

if [ "$1" = "--link" ]; then
    echo "🔗 创建全局符号链接..."
    sudo ln -sf "$SCRIPT_DIR/skill-validator.sh" /usr/local/bin/skill-validator 2>/dev/null || true
    sudo ln -sf "$SCRIPT_DIR/skill-validator.sh" /usr/local/bin/validate-skill 2>/dev/null || true
fi

# 创建验证规则

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 79)May include surrounding context.

sh

{
  "dangerous_patterns": [
    "rm -rf /",
    "chmod 777",
    "password.*=",
    "api_key.*=",
    "secret.*=",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is written entirely in Chinese, which signals a language-specific skill presentation without offering any user choice or documenting a locale-specific constraint. Under the policy, language/locale restrictions should be optional or clearly justified rather than implicitly enforced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.