Token消耗优化器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.5.0

Overview

This token-cost optimization skill is mostly documentation, but it under-specifies sensitive cache sharing, session-log analysis, and automatic configuration changes.

Review this skill before installing if you use agents on private code, logs, or multi-agent workflows. Only allow cache sharing and failed-session analysis with explicit opt-in, per-workspace isolation, secret redaction, short retention, and human-approved config diffs with rollback. Expect responses to default to Chinese unless the skill is changed or overridden.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:118

Finding

Overbroad Agent Session-Log Access and Automatic Configuration Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 118
Vulnerability Type: Excessive access to historical session data and unauthorized configuration mutation
Risk Level: Medium

Source excerpt translated into English:

markdown

**Failed-session mining (headroom learn mode):** Analyze failed Agent session logs, identify error patterns, and automatically correct configuration files. Benchmark: 9 failed sessions / 378 calls → saves 8,000 tokens per session.

Technical Analysis

The Skill instructs the Agent to inspect failed Agent session logs and automatically modify configuration files. Token-cost analysis does not inherently require unrestricted access to historical session content or permission to mutate configuration, so these instructions exceed least-privilege requirements.

Session logs may contain private conversations, source code, filesystem paths, tool results, API responses, authentication material, or other sensitive data. The Skill does not specify:

• Which sessions or log fields may be accessed.
• How secrets and personal data must be redacted.
• Which configuration files may be changed.
• Whether proposed changes require user approval.
• Whether backups, validation, or rollback are mandatory.

Although the project contains no executable implementation, an Agent following these instructions with filesystem or configuration tools could exercise the Agent's existing privileges without a sufficiently constrained authorization boundary.

Attack Path

1. A user invokes the Skill to reduce token consumption.
2. The Agent enables the failed-session mining recommendation.
3. The Agent searches historical session logs using its available filesystem or platform permissions.
4. Sensitive content from unrelated or previous sessions is loaded into the active context.
5. The Agent derives configuration changes from the logs.
6. The Agent automatically writes those changes without ...[truncated 846 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before reading any historical session logs.
• Restrict analysis to user-selected sessions and fields required for token metrics.
• Extract aggregate measurements instead of loading full conversation content whenever possible.
• Redact API keys, credentials, personal data, source code, and confidential tool output before analysis.
• Define an allowlist of configuration files and settings that may be proposed for modification.
• Replace automatic configuration mutation with a review workflow that presents the exact proposed diff.
• Require separate confirmation before applying each persistent change.
• Create a backup and provide a tested rollback procedure before configuration writes.
• Record an audit log containing accessed resources, proposed changes, approvals, and results.
• Deny access to unrelated users, tenants, workspaces, and sessions by default.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:116

Finding

Cross-Agent Cache Sharing Without Defined Authorization or Isolation Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 116
Vulnerability Type: Uncontrolled cross-Agent sharing of cached tool output
Risk Level: Medium

Source excerpt translated into English:

markdown

**Cross-Agent cache sharing:** Multiple Agents can share compressed caches. For example, after Claude performs a review, Codex performs testing, and Cursor performs refactoring, the latter two directly reuse the first Agent's cache index, saving 40–60% of initial scanning tokens.

Technical Analysis

The CCR design described by the Skill retains original tool output locally and permits later retrieval through cache identifiers. Sharing those cache indexes across Agents can transfer access to the underlying original content.

The Skill does not define:

• Cache ownership or per-user authorization.
• Tenant, workspace, task, or provider isolation.
• Authentication for retrieval operations.
• Encryption at rest or in transit.
• Secret redaction before cache creation.
• Expiration, revocation, or secure deletion.
• Integrity checks for retrieved entries.
• Explicit user consent for cross-Agent sharing.

A cache index may therefore function as a bearer capability: any Agent that receives or discovers it could potentially retrieve the associated content. This is particularly risky when Agents belong to different providers or execute under different trust boundaries.

Attack Path

1. Agent A processes source code, logs, API results, or another sensitive tool response.
2. The CCR mechanism stores the original response and produces a cache index.
3. The cache index is shared with Agent B to reduce repeated scanning.
4. Agent B uses the retrieval mechanism to restore details from Agent A's cache.
5. Without ownership and authorization checks, Agent B accesses content outside its intended task or trust boundary.
6. The restored content enters Agent B's model context and may be disclosed thr ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

• Scope every cache entry to a specific user, tenant, workspace, task, and trust domain.
• Disable cross-Agent and cross-provider sharing by default.
• Require explicit user consent before sharing a cache entry outside its original task.
• Authenticate every retrieval request and verify authorization against cache ownership metadata.
• Use opaque, high-entropy identifiers that do not serve as authorization credentials by themselves.
• Encrypt cached content at rest and protect retrieval channels in transit.
• Redact secrets and sensitive personal data before caching.
• Apply short, configurable retention periods with automatic expiration and secure deletion.
• Provide immediate revocation of shared access.
• Add cryptographic integrity verification and reject stale or modified entries.
• Maintain audit records for cache creation, sharing, retrieval, revocation, and deletion.
• Share minimized derived data rather than original tool output whenever reversible retrieval is unnecessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases and activation conditions are very broad and overlap with common discussions about cost, efficiency, RAG, caching, and prompt design. This can cause the skill to activate in contexts where the user did not explicitly request token-optimization behavior, potentially altering outputs, encouraging unnecessary compression, or changing model/caching decisions in ways that affect quality, privacy, or user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill proposes mining failed agent session logs and automatically correcting configuration without clear consent, redaction requirements, or change-control safeguards. Failed-session logs often contain sensitive prompts, tool outputs, secrets, identifiers, or proprietary data, and automated config changes can create unintended system behavior if applied without human review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction “中文输出” imposes a fixed language requirement. There is no opt-in, fallback, or explanation that the skill is intended only for Chinese-speaking or region-specific use, so it conflicts with the policy against forced language/locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire document is written in Chinese and presents the skill reference as a fixed-language resource, with no indication that users may choose another language or opt into Chinese-only behavior. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.