Security audit

hv-analysis

Security checks for vulnerabilities and agentic risk

Overview

This deep-research skill matches its stated purpose, but it needs Review because it can activate broadly, install host Python packages, inspect another local skill path, and create report files without an explicit approval checkpoint.

Install only if you want an agent to run a full web-backed research workflow that may spawn subagents, use curl or web tools, write Markdown/HTML/PDF files in the workspace, and install Python packages. Before use, ask the agent to confirm exact output paths and any package installation command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs reading and writing local files, including creating Markdown and PDF outputs, but it does not declare permissions or clearly scope those filesystem operations. Hidden or undeclared file access increases the risk that the agent modifies the workspace in ways the user did not anticipate, especially when combined with broad auto-trigger behavior.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to run shell commands such as pip install and curl, which expand its behavior from research into environment modification and arbitrary network interaction. Installing packages and invoking shell tools can change the host environment, introduce supply-chain risk, and bypass safer built-in tools if done automatically.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger phrases are extremely broad, including everyday requests like '帮我分析' or '帮我了解一下XX', which can cause the skill to activate in many contexts where the user did not intend a heavy research workflow. In this skill, accidental activation is more dangerous because it can lead to network access, skill enumeration, file creation, and package installation without clear, narrow invocation boundaries.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to write Markdown files, generate PDFs, and potentially install dependencies, but it does not require a user-visible warning or consent before making those changes. This can surprise users, overwrite workspace files, or alter the runtime environment as a side effect of what appears to be a content-generation task.

Skill Enumeration

Medium

Category: Agent Snooping
Content: > > - **WebSearch**：用于搜索发现信息来源，获取摘要和关键词结果 > - **WebFetch**：当已知具体URL时，用于从页面定向提取内容 > - 如果用户环境中安装了 web-access skill（检查路径 `/mnt/.claude/skills/web-access/SKILL.md` 是否存在），优先加载它并遵循其指引，它提供更强的浏览器CDP能力 > - 搜索策略：先用WebSearch发现信息来源和线索，找到具体URL后用WebFetch深入提取 > - 多次搜索、多个关键词组合，不要只搜一次就放弃 > - 一手来源优于二手来源：官方博客 > 权威媒体原创报道 > 转载/聚合
Confidence: 88% confidence
Finding: The instruction to check whether `/mnt/.claude/skills/web-access/SKILL.md` exists reveals and depends on the local skill layout, which is a form of environment/skill enumeration. Enumerating installed capabilities can leak platform details and enable adaptive behavior based on what tools are available, increasing attack surface when combined with broad activation and external access.

Static analysis

No suspicious patterns detected.