Skill矩阵分发助手（免费版）

• Outcome: Review
• Latest audit: Jun 25, 2026 · 6:35 AM UTC
• Version: 3.7.15

Overview

This appears to be a real multi-platform skill publishing helper, but it needs review because it permanently stores platform credentials and can publish, update, or delete account content.

Install only after reviewing the remote scripts and deciding whether you are comfortable storing platform tokens in a local config.json. Use least-privileged tokens, avoid putting secrets in any skill directory that may be uploaded, keep dry-run enabled for destructive actions, and require exact IDs before allowing deletion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a distribution assistant, but it also includes workflows to delete existing platform content. That expands its capability from publishing into destructive account operations, increasing the chance of accidental or socially engineered deletion. In a conversational agent context, destructive actions are especially risky because ambiguous user prompts can be misinterpreted.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill mandates permanent storage of all user-provided credentials in config.json and forbids re-asking. This is broader than necessary, creates a long-lived local secret store, and increases exposure if the file is read by other skills, malware, backups, or source control. The risk is amplified because the credentials cover multiple external platforms and grant publishing or account access.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The documented behavior includes deleting platform content as part of fixing mistaken publication flows, despite the stated purpose being skill distribution. That gives the agent destructive authority beyond what users would reasonably expect from a publishing helper and can lead to irreversible loss if triggered incorrectly. The surrounding instructions normalize deletion as an operational step, which increases danger in real use.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill instructs permanent storage of sensitive credentials without an explicit warning or consent flow. Users may provide API keys expecting transient conversational use, but the skill silently converts them into persistent local secrets, creating confidentiality and downstream account-takeover risk. Because these secrets span multiple services, compromise of the config file could affect several external accounts at once.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The deletion workflow is irreversible, but the skill's top-level framing does not prominently warn users that destructive actions are supported. In agent settings, users often trust a publishing assistant to be non-destructive, so insufficient warning raises the likelihood of harmful mistakes. Even with a confirmation step, the hidden destructive scope makes this risk real.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Requiring persistent storage of all credentials in config.json without re-asking is a direct secret-handling weakness. It normalizes indefinite retention, increases blast radius if the file is exposed, and removes a natural checkpoint where the user might reconsider sharing privileged tokens. In a skill that interfaces with multiple publishing platforms, this can enable broad unauthorized actions if leaked.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

--invitation-code XXXX-XXXX

# 确认删除
python matrix_publish.py delete /path/to/your-skill \
  --api-key sk-xxxxxxxx \
  --invitation-code XXXX-XXXX --confirm

• Confidence: 93% confidence
• Finding: The skill exposes a delete command that can act on user-supplied paths and credentials to perform irreversible platform deletion. In an agent/tooling environment, such commands are susceptible to misuse through ambiguous prompts, social engineering, or unsafe parameter passing, especially when paired with saved credentials. The context makes this more dangerous because the tool is packaged as a convenience assistant rather than an obviously destructive admin utility.

Static analysis

No suspicious patterns detected.