Ai Bug Fixer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill does not appear to steal data or install anything persistent, but its advertised AI bug-fixing capability is not supported by the hardcoded demo scripts users would run.

Install only if you understand this appears to be a demo-style bug-fixing helper, not a real AI repair system. Do not rely on its diagnostics, confidence scores, or generated patches for production code unless you independently inspect the code, run tests, and confirm the scripts have been replaced with real analysis logic.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill repeatedly claims AI/LLM-driven automated repair capabilities, but the file does not document any concrete model-backed mechanism or bounded workflow showing how those claims are fulfilled. Overstated automation in a bug-fixing context can cause unsafe reliance on generated changes and conceal the real limits of the skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill repeatedly claims AI/LLM-driven automated repair capabilities, but the file does not document any concrete model-backed mechanism or bounded workflow showing how those claims are fulfilled. Overstated automation in a bug-fixing context can cause unsafe reliance on generated changes and conceal the real limits of the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: The skill advertises executable workflows that imply code capabilities, including potential network use, but it does not declare any tool scope such as permissions or allowed-tools. Missing capability boundaries increases the risk of the skill being granted broader access than necessary or behaving unpredictably when invoked in environments with tool access.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger conditions are very broad, covering nearly any user request related to debugging, fixes, tests, or patches. Overbroad activation boundaries can cause the skill to trigger in unintended contexts, increasing the chance of unsolicited code modification guidance or inappropriate handling of sensitive code and logs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill discusses automatic fixes and patch generation without warning that outputs may alter code and should be reviewed before use. In a code-editing context, lack of review guidance can directly lead users to apply incorrect or unsafe changes, potentially introducing new vulnerabilities or breaking production systems.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This Python file contains user-facing natural language exclusively in Chinese, including the module description and function docstring, with no indication that language selection is optional. That creates a locale-policy concern because the skill appears to impose a specific language on users without opt-in or a documented region-specific reason.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module description is written as an instructionally Chinese-only skill description ('日志分析器 - 分析日志定位bug'), and the user-facing strings throughout the file are also fixed in Chinese. The file provides no opt-in, language selection, or justification that this is a region-specific tool, which can violate language/locale policy requirements.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The function presents itself as analyzing the supplied log and pattern, but it never reads or parses the input and instead returns fabricated, hardcoded results. In a bug-fixing or incident-analysis skill, this can mislead users into acting on false diagnostics, causing incorrect remediation decisions and masking real operational or security issues.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module docstring presents the skill entirely in Chinese, and the user-facing strings later in the file also enforce Chinese-language interaction. For a general-purpose patch generator, this appears to impose a specific language/locale without opt-in or documented regional justification, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language description is presented in Chinese and the skill does not indicate that this locale is optional or required for a region-specific purpose. This can violate language or locale policy when users are not given a choice of language.

Static analysis

No suspicious patterns detected.