Security audit

模型蒸馏大师

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate model-distillation skill, but it can install software, download large models, run model-supplied code, and process user data with too little upfront control.

Use this only in a controlled ML environment such as a container or disposable project directory. Before installation or activation, review and approve any pip, apt-get, brew, git-lfs, git clone, model download, training, deployment, and teacher-API steps. Avoid sensitive or regulated data unless you have approved the external teacher provider and retention policy, and disable or restrict trust_remote_code unless the model repository is pinned and trusted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code advertises a human approval gate but then hard-codes approval by setting `user_approved=True` and continuing automatically. This defeats the control-flow safeguard and can cause the workflow to proceed with training, data generation, and delivery actions without any real user consent, which is especially risky in an agent workflow where approval is meant to bound resource use or risky operations.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script goes beyond downloading a model and attempts to modify the host by installing git-lfs via system package managers. In an agent/skill context, this expands the capability from a local file operation into privileged environment modification, which can be unsafe on production hosts, CI runners, or shared machines and may trigger unintended package changes without explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script loads both tokenizer and model with trust_remote_code=True, which allows arbitrary Python from a model repository or local model package to execute during evaluation. Because the inputs are user-supplied model paths in an evaluation workflow, a malicious model can achieve code execution on the host running the evaluator, making this more dangerous than a purely local/offline utility issue.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The script advertises adversarial sample mining for distillation, but the actual labeling logic is just random coin-flip simulation of teacher and student correctness. In this skill context, that is security-relevant because it can silently poison the training/evaluation pipeline with fabricated 'hard' examples, misleading users into trusting invalid model-improvement outputs and degrading downstream model quality.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script invokes system package managers (apt-get or brew) to install git-lfs automatically, which modifies the host environment beyond the immediate project directory. In an agent skill context, making OS-level changes without explicit confirmation increases risk because it can affect unrelated software, require elevated privileges, and surprise users who expected only local project setup.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The script performs a network fetch by cloning a remote model repository, which introduces supply-chain and transparency risks if users are not clearly warned beforehand. While downloading a model is consistent with the skill's purpose, silently pulling remote content and writing it to disk can still be unsafe in automated or restricted environments.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs immediate execution of package installation, git-lfs setup, repository cloning, and filesystem changes before explicit user approval. In an agent setting, this can alter the host environment, consume bandwidth and disk, introduce unreviewed dependencies, and potentially execute supply-chain-risky installation steps without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to call external teacher-model APIs on user/task data without warning that prompts, training samples, or proprietary content may be transmitted to third-party services. This can cause unintentional disclosure of sensitive data, contractual violations, or compliance issues, especially in enterprise or regulated contexts.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill specifically instructs collection and storage of teacher-model chain-of-thought outputs, which may expose sensitive reasoning traces and may violate provider policies or usage constraints. Persisting such outputs can create legal, privacy, and data handling risks beyond ordinary API usage because reasoning traces often contain more detailed intermediate content than final answers.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill describes a workflow that performs data synthesis, training, evaluation, and model delivery, but it does not warn users about resource consumption, data handling, or the possibility of operating on sensitive inputs. In an agent context, documenting system-impacting operations without safety gates can encourage execution of expensive or privacy-affecting actions without informed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script writes YAML to a user-controlled output path without validation, confirmation, or restriction to a safe directory. In an agent or automated workflow, this can overwrite arbitrary files writable by the process, causing configuration corruption, data loss, or clobbering of sensitive local files; the distillation-tool context makes this somewhat more relevant because output paths are likely to be supplied programmatically.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script installs Python packages with pip and may also install git-lfs via system package managers without any interactive confirmation or dry-run mode. This is dangerous because it changes the execution environment, may pull unpinned packages from external registries, and can trigger privileged operations unexpectedly on the host system.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The script clones a remote repository and downloads a model without an upfront warning about network access, storage impact, or the provenance of the fetched content. In automation contexts, undisclosed network and disk side effects are a meaningful security concern even when aligned with the skill's functionality.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase "把模型蒸馏到" is broad and likely to match ordinary user requests about model compression or transfer, which can cause this skill to activate unintentionally. In an agentic skill, overbroad activation can route users into workflows they did not explicitly request, increasing the chance of prompt hijacking, unintended tool usage, or inappropriate execution of a complex ML pipeline.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The prompt explicitly asks the teacher model to reveal detailed chain-of-thought and intermediate reasoning for each input, then stores that output into a dataset. This can cause overcollection of sensitive content, reproduction of user-provided secrets in reasoning traces, and retention of hidden or policy-sensitive reasoning that should not be logged or used for distillation.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/distill_train.py:212

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/evaluate.py:29