Security audit

龙虾Skill雷达

Security checks for vulnerabilities and agentic risk

Overview

This skill has a real asset-discovery purpose, but it asks for broad local file, chat-history, memory, and publishing authority that users should review carefully.

Install only if you are comfortable granting this skill access to local WorkBuddy skill folders and potentially chat history, memory, sessions, and broad drive searches. Prefer narrowing the scan scope, disabling chat-history and memory searches unless truly needed, and requiring a fresh confirmation before any upload or multi-platform distribution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 76% confidence
Finding: The skill states that scans must only occur after explicit authorization, but later execution paths rely on follow-up user commands like upload/distribute without clearly binding those actions to the original consent scope. In a privacy-sensitive skill that reads local files and user data stores, losing that authorization state can lead to actions proceeding outside what the user explicitly approved.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The design section says this skill should only discover assets while a separate helper performs distribution, but Step 4 instructs the radar itself to read full files, invoke publishing logic, and push content to external platforms. That boundary mismatch increases the chance of privilege creep and user confusion about which component is accessing and transmitting data.

Ssd 3

High

Confidence: 95% confidence
Finding: The skill instructs the agent to read WorkBuddy chat records, memory files, and session history, then mine and surface prior user content as scan results. Even if framed as local discovery, this creates a natural-language exfiltration path where sensitive historical data can be retrieved, summarized, or revealed beyond the user's immediate intent.

Ssd 3

High

Confidence: 94% confidence
Finding: The skill suggests searching historical conversations by arbitrary user-provided keywords and returning matching content. That capability can expose secrets, personal data, credentials, or other sensitive prior inputs through broad natural-language retrieval rather than a constrained data-access workflow.

Static analysis

No suspicious patterns detected.