Security audit

Sites to IMA

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its website-to-knowledge-base purpose, but it includes unsafe package-manager recovery commands and broad update triggers that can modify notes and knowledge-base records.

Install only if you are comfortable giving the skill authority to crawl websites, create and append IMA notes, import batches of URLs into a knowledge base, and store local progress. Avoid letting an agent run the dpkg lock-removal troubleshooting command automatically, and prefer explicit update requests naming the exact site and target knowledge base.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The template explicitly instructs the agent to respond to WAF blocks with backoff-and-retry logic, which normalizes continuing access attempts against a defensive control rather than treating the block as a stop condition requiring user review. In a site-ingestion skill, this increases the risk of unauthorized scraping behavior, terms-of-service violations, and escalation from normal collection into anti-bot evasion.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The update triggers are broad natural-language phrases like “更新知识库” and “XX 更新”, which can overlap with ordinary conversation and cause unintended execution of a high-impact workflow. In this skill’s context, a mistaken trigger can initiate scraping, note writes, local progress updates, and knowledge-base imports, so the consequence is more than a harmless UX issue.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The phrase '更新知识库 / 更新{站点名}' is broad enough to be triggered during ordinary conversation, yet it maps to a workflow that performs scraping, note mutation, and knowledge-base imports. Because the action is state-changing and multi-step, ambiguous activation can cause the agent to begin high-impact operations without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The execution condition '用户说"更新知识库"时' lacks scoping to a specific site, notebook, or prior setup, even though the workflow mutates multiple notes, local files, and KB records. In a skill designed for repeated updates, this ambiguity makes accidental or context-confused execution materially more likely.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: From the outset, the template instructs generation of a manual and writing it into a user-specified notebook, but it does not require any user-facing disclosure that records will be created or modified. This is risky because the skill performs persistent state changes, and silent writes can surprise users or be abused to alter notebooks under weak or inferred consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: These steps direct bulk import of external URLs into knowledge-base folders, delayed reconciliation, and updates to multiple notes and local datasets, yet the template omits any explicit warning or consent checkpoint for those mutations. In context, this is more dangerous than a simple note edit because it can ingest unreviewed external content at scale and alter several persistent stores in one command.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - playwright 优先装进本地 venv 固定路径（uvx 冷启动 monorepo 依赖易超时）。 - **`playwright install` 直连下载必超时**，必须设 `PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright/`（镜像约 30 秒装完）。 - **不要用 `chromium-headless-shell`**（旧版无头，指纹特征明显，CF 必拦）；要装完整版 `chromium`（new headless）。apt 装 chromium 完整包会 OOM(exit 137)，不要尝试。 - apt 报锁占用（前次超时进程残留）：`kill -9 <pid>; rm -f /var/lib/dpkg/lock*; dpkg --configure -a` 后重试。 - 有头模式运行：`xvfb-run -a --server-args="-screen 0 1280x800x24" <python脚本>`。 - 以上全部就位**仍过不了强 CF 站点**（见「站点可行性限制」），环境配置只解决"能跑"，不解决"能过"。
Confidence: 89% confidence
Finding: The skill includes guidance to run destructive system-level commands such as removing dpkg lock files under /var/lib/dpkg. In an agentic environment, operational instructions like this can lead to unsafe execution, breaking package-manager state or interfering with unrelated processes if followed automatically or without strict validation.

Chaining Abuse

High

Category: Tool Misuse
Content: - playwright 优先装进本地 venv 固定路径（uvx 冷启动 monorepo 依赖易超时）。 - **`playwright install` 直连下载必超时**，必须设 `PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright/`（镜像约 30 秒装完）。 - **不要用 `chromium-headless-shell`**（旧版无头，指纹特征明显，CF 必拦）；要装完整版 `chromium`（new headless）。apt 装 chromium 完整包会 OOM(exit 137)，不要尝试。 - apt 报锁占用（前次超时进程残留）：`kill -9 <pid>; rm -f /var/lib/dpkg/lock*; dpkg --configure -a` 后重试。 - 有头模式运行：`xvfb-run -a --server-args="-screen 0 1280x800x24" <python脚本>`。 - 以上全部就位**仍过不了强 CF 站点**（见「站点可行性限制」），环境配置只解决"能跑"，不解决"能过"。
Confidence: 91% confidence
Finding: The skill presents a semicolon-chained shell sequence (`kill -9 <pid>; rm -f ...; dpkg --configure -a`) that combines forceful process termination, file deletion, and package reconfiguration in one line. Chained commands are dangerous in agent workflows because partial mis-substitution or overbroad execution can amplify damage and make it easier to execute unintended destructive actions without intermediate checks.

Static analysis

No suspicious patterns detected.