技能检索

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:42 PM UTC
• Version: 1.0.0

Overview

This is a disclosed skill search and ranking helper that can install skills when explicitly asked, so it should be used carefully but does not show hidden or malicious behavior.

Use this for finding and comparing skills, but treat --install as a security-sensitive action. Prefer --dry-run first, verify the skill name, source, and publisher, and avoid storing GitHub tokens in plaintext config unless you understand the local exposure risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # Run with real-time output
        process = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,

• Confidence: 84% confidence
• Finding: The script's stated purpose is ranking/discovery, but it also executes external installer CLIs to install arbitrary skills selected from remotely fetched catalogs. That creates a real code-execution trust boundary: if a malicious or compromised remote catalog entry is installed, the downstream CLI may fetch and execute untrusted package content on the user's machine.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises and instructs use of capabilities including network access, local file/database access, environment inspection, and shell execution, yet it declares no permissions or trust boundaries. That mismatch prevents meaningful consent and review, and is especially risky because the documented workflow includes updating from remote sources and installing software via CLI, which can change the host system.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This is a true security concern in context because a discovery/ranking tool is directly wired to install external skills via package-manager-like CLIs. The combination of remote catalog ingestion and one-command install materially lowers the barrier to executing untrusted third-party code, increasing supply-chain risk if the upstream source, metadata, or publisher is malicious or compromised.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad and common, such as requests for recommendations, rankings, searching, and installation, making accidental activation likely during normal conversation. In this skill, accidental invocation is more dangerous than usual because the described workflow can perform network fetches, local scanning, and potentially software installation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown instructs the agent to fetch remote data and install skills through external CLIs, but it does not present a clear warning that external services will be contacted or that the local system may be modified. Users may believe they are only receiving recommendations while the skill can update a database, auto-scan local skills, and execute installation commands against third-party sources.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The find-skills description is very broad: it activates whenever a user asks how to do something, looks for a skill, or wants to extend functionality. In a skill-ranking/discovery system, that kind of overlap can cause this skill to trigger on many unrelated requests, leading to inappropriate routing, unintended installs, or privilege expansion through unnecessary skill discovery flows.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The self-improving-agent entry includes trigger wording like 'when a command or operation unexpectedly fails' and 'when the user corrects', which are generic conditions that can arise across many tasks. That ambiguity can cause the skill to activate outside its intended scope, potentially injecting self-modification or memory behaviors into normal task handling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill-creator entry says it should be used when the user wants to create a new skill or update an existing one to extend capabilities, but the phrasing lacks clear limits and can overlap with general requests about improving tools or workflows. In this context, ambiguous triggering is risky because it may steer ordinary conversations into code-generation or system-extension paths that carry higher security and integrity risk.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The documentation encourages use of a GitHub token for higher API limits but provides no guidance on secure handling, such as avoiding logs, shell history, or plaintext config storage. In a skill ecosystem where third-party code and automation may be present, poor credential hygiene increases the chance of token exposure and subsequent repository or account abuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Including a `github_api_token` field in a JSON config under the user's home directory normalizes plaintext credential storage. If file permissions are weak, backups are exposed, or other local tools can read the file, the token may be stolen and used to access GitHub resources within its granted scope.

Static analysis

No suspicious patterns detected.