Security audit

自动化测试助手

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent automation-testing helper skill with ordinary testing examples, but users should keep generated tests pointed at authorized non-production systems.

Before installing, understand that this skill can help generate tests that log in, create records, control mobile emulators, change network state, install test dependencies, and run in CI. Use it with test accounts, test devices, and staging or local endpoints unless you explicitly intend to exercise production systems.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill’s activation description is overly broad, matching many generic testing-related conversations without clear boundaries. This can cause the skill to trigger in contexts where users did not intend code-generation or test-execution guidance, increasing the chance of producing potentially impactful automation against real systems without sufficient confirmation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill includes examples that perform state-changing actions such as login attempts, user creation, mobile device control, network toggling, and CI execution, but it does not warn users about risks to production systems, accounts, devices, or data. In a testing-assistant context, such examples are plausible and therefore more likely to be copied directly into real environments, making accidental misuse more dangerous.

Static analysis

No suspicious patterns detected.