T07 · Tool Hijacking and Spoofing
Error
- Location
install.py:94- Finding
Installer Unconditionally Replaces an Existing Global Command
- Content
View full analysis
- Remediation
View remediation
Security audit
文件管理大师
Security checks for vulnerabilities and agentic risk
Overview
This is a local file-management tool, but its installer and documentation create enough file-safety and system-command concerns that users should review it before installing.
Install only if you are comfortable reviewing the code first. Avoid running the installer with elevated privileges, check for an existing file-master command before installation, and do not run recursive rename or organize commands on important folders without an external backup. Treat the advertised delete, convert, compress, undo, and automation features as unsupported in this artifact.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
file_master.py:140- Finding
Rename Pattern Allows Files to Be Moved Outside the Selected Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
file_master.py:80- Finding
Predictable Backup Names Allow Silent Backup Overwrites
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
总体上，这段代码确实是一个文件批量处理/管理工具，核心能力与“重命名、整理、搜索”基本一致，因此大方向匹配。但声明中特别提到“转换”等操作，而实际代码并未实现任何转换能力，这是显著的描述与行为不一致。另外，代码还提供了重复文件查找、自动备份、操作日志保存等附加功能，虽仍属于文件管理范畴，但未在描述中体现。基于评估标准，应判定存在一定程度的能力描述不准确，因此标记为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents the skill as a file batch-processing tool for operational use, but the supplied code chunk is not the implementation of such a tool; it is a manual test script validating another module (
file_master). Its primary purpose is testing, creating temporary test data, invoking FileMaster methods, and reporting results. That is materially different from the declared user-facing functionality. The tested behaviors do align partially with the description (renaming, organizing, searching), and duplicate finding is related to file management, but the code chunk itself does not implement conversion and instead adds a testing capability/purpose not declared. Therefore this chunk does not accurately represent the declared description.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill description is written in Chinese and does not indicate that other languages are supported or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises and demonstrates shell execution, file reads/writes, and environment-sensitive operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens security boundaries because an agent or reviewer cannot easily constrain what the skill may access, especially given the presence of destructive commands like delete, move, backup, and automation workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation promotes auto-cleanup and duplicate deletion workflows, including a '--delete' path, without a strong warning about irreversible data loss or clear safe defaults such as dry-run mode. In a file-management skill, this is especially dangerous because users may execute examples verbatim and unintentionally destroy data across large directory trees.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The name, description, changelog, and author metadata are presented in Chinese, but the manifest does not indicate that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate language/locale policy expectations when a skill implicitly forces a specific language without user opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains user-facing natural-language strings and descriptions entirely in Chinese, including the module description and class docstring. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
All user-facing natural-language strings in the installer and generated README are written in Chinese, with no indication that another language can be selected. This imposes a locale/language choice on users without opt-in, which matches the language-policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installer copies files, creates launchers, writes configuration under the user's home directory, and may alter PATH or create a global symlink without any confirmation prompt. Silent environment and filesystem modification increases the chance of unintended persistence, command hijacking conflicts, and user surprise, especially for a skill presented as a simple file-management tool.
- Content
Tainted flow: 'dst_path' from os.environ.get (line 44, credential/environment) → shutil.copy2 (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python dst_path = install_dir / dst_name if src_path.exists(): shutil.copy2(src_path, dst_path) print(f" ✅ {src_name} -> {dst_name}") else: print(f" ⚠️ {src_name} 不存在，跳过")
Tainted flow: 'bat_path' from os.environ.get (line 58, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python python "{install_dir}\\file_master.py" %* ''' bat_path = install_dir / 'file-master.bat' with open(bat_path, 'w', encoding='utf-8') as f: f.write(bat_content) # 添加到PATH（需要管理员权限）
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The installer modifies the execution environment by adding its directory to PATH on Windows and attempting to create a global command symlink under /usr/local/bin on Unix-like systems. This increases the tool's reach system-wide and can overwrite an existing command name, creating persistence and command-shadowing risk if the installed script is later replaced or abused.
- Content
Tainted flow: 'script_path' from os.environ.get (line 86, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python python3 "{install_dir}/file_master.py" "$@" ''' script_path = install_dir / 'file-master' with open(script_path, 'w', encoding='utf-8') as f: f.write(script_content) # 设置执行权限
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python print(" ✅ 已创建符号链接到 /usr/local/bin/file-master") except PermissionError: print(" ⚠️ 需要sudo权限创建符号链接") print(f" 请手动运行: sudo ln -s {script_path} /usr/local/bin/file-master") # 创建配置文件目录 config_dir = Path.home() / '.file-master'
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 测试重命名 print("\n1. 测试重命名功能...") result = subprocess.run([ sys.executable, "file_master.py", "rename", str(test_dir), "--pattern", "file_{num:03d}{ext}" ], capture_output=True, text=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 测试整理功能 print("\n2. 测试整理功能...") result = subprocess.run([ sys.executable, "file_master.py", "organize", str(test_dir) ], capture_output=True, text=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 测试搜索功能 print("\n3. 测试搜索功能...") result = subprocess.run([ sys.executable, "file_master.py", "search", str(test_dir), "--content", "Test" ], capture_output=True, text=True)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest fields and all user-facing instructions are presented in Chinese, which effectively forces a specific language for operation and documentation. The file does not indicate that the skill is China-specific or provide any user opt-in or alternative language option.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest describes a wide range of actions such as renaming, organizing, searching, and converting files, but it does not specify what user requests or contexts should activate the skill versus when it should not. For a manifest file, that broad natural-language scope can lead to ambiguous invocation because there are no explicit trigger phrases, boundaries, or exclusion examples.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says the skill supports '转换' (conversion) in addition to renaming, organizing, and searching. Across the implementation and CLI, the code only provides rename, organize, search, duplicate detection, backup, and logging functions, with no file conversion logic or conversion command.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes batch file management focused on renaming, organizing, searching, and conversion. The duplicate-detection feature computes file hashes and reports duplicate groups, which is a materially different capability not mentioned in the stated scope.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The generated README advertises features including format conversion, file compression, operation undo, and permission-check protection, but this script only creates files, installs the tool, and runs a few rename/organize/search tests. Because the documentation presents concrete capabilities that are not reflected in the code shown here, it creates an intent/documentation divergence.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The package description is written only in Chinese, while the manifest provides no indication that the skill is region-specific or that users can choose a preferred language. Under the policy, language constraints should be justified or offer opt-in rather than implicitly forcing a locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings, comments, and docstrings that consistently force a specific language/locale for user-visible output. Under the policy, a skill should not require a specific language unless the user opts in or the locale restriction is clearly justified.
- Content