Back to skill

Security audit

Skill Security Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly works as a local static scanner, but it also ships undisclosed network reconnaissance utilities that are broader than its stated purpose.

Install only if you are comfortable reviewing or removing the bundled network checker modules. The normal scanner command appears to read only the target skill directory, but the package contains extra code that could scan hosts and reveal local network/firewall details if imported or invoked by another path.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
checkers/network_checker.py:24
Finding

Out-of-Scope Runtime Network and Environment Reconnaissance

Content
View full analysis
bool: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(self.timeout) result = sock.connect_ex((host, port)) sock.close() return result == 0 except Exception: return False def scan_common_ports(self, host: str) -> Dict[int, str]: open_ports = {} for port in self.common_ports: if self.check_port_open(host, port): service_name = self._get_service_name(port) open_ports[port] = service_name return open_ports ``` It also executes operating-system utilities to enumerate firewall state and probe arbitrary hosts: ```python if system == 'windows': result = subprocess.run( ['netsh', 'advfirewall', 'show', 'allprofiles'], capture_output=True, text=True, timeout=self.timeout ) elif system == 'linux': try: result = subprocess.run( ['iptables', '-L'], capture_output=True, text=True, timeout=self.timeout ) except FileNotFoundError: try: result = subprocess.run( ['ufw', 'status'], capture_output=True, text=True, timeout=self.timeout ) except FileNotFoundError: pass ``` ```python def check_network_connectivity(self, target_hosts: List[str]) -> Dict[str, bool]: ...[truncated 4861 chars]
Remediation
View remediation

other

Warning
Location
checkers/checkers/network_checker.py:27
Finding

Duplicated Out-of-Scope Reconnaissance Implementation Increases Exposed Attack Surface

Content
View full analysis
bool: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(self.timeout) result = sock.connect_ex((host, port)) sock.close() return result == 0 except socket.gaierror: return False except socket.timeout: return False except ConnectionRefusedError: return False ``` ```python def scan_common_ports(self, host: str) -> Dict[int, str]: open_ports: Dict[int, str] = {} for port in self.common_ports: if self.check_port_open(host, port): service_name = self._get_service_name(port) open_ports[port] = service_name return open_ports ``` It executes local firewall and connectivity commands, including an additional `systemctl` fallback: ```python result = subprocess.run( ['iptables', '-L'], capture_output=True, text=True, timeout=self.timeout ) result = subprocess.run( ['ufw', 'status'], capture_output=True, text=True, timeout=self.timeout ) result = subprocess.run( ['systemctl', 'status', 'firewalld'], capture_output=True, text=True, timeout=self.timeout ) ``` ```python if system == 'windows': result = subprocess.run( ['ping', '-n', '1', '-w', f'{self.timeout * 1000}', host], capture_output=True, text=True, timeout=self.timeout+1 ) else: result = subprocess.run( ['ping', '-c', '1', '-W', str(self.timeout), host], capture_output=True, text=True, timeout=self.timeout+1 ) ``` It also ...[truncated 2882 chars]
Remediation
View remediation
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (54)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose is static security scanning of third-party skills, but the detected behaviors extend into active host/network reconnaissance such as port probing, SSL inspection, ping/DNS checks, local IP enumeration, and firewall-status checks. Those capabilities materially exceed the stated use case and can be repurposed for environmental discovery, making the skill more dangerous because users may grant trust based on the benign 'security scanner' label.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · checkers/checkers/sensitive_checker.py (reported line 217)May include surrounding context.

python
findings.extend(self.check_file(str(file_path)))
        
        # 检查配置文件
        config_files = ['*.env', '*.ini', '*.cfg', '*.conf', 'config.*']
        for pattern in config_files:
            for file_path in path.rglob(pattern):
                findings.extend(self.check_file(str(file_path)))

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · checkers/sensitive_checker.py (reported line 159)May include surrounding context.

python
findings.extend(self.check_file(str(file_path)))
        
        # 检查配置文件
        config_files = ['*.env', '*.ini', '*.cfg', '*.conf', 'config.*']
        for pattern in config_files:
            for file_path in path.rglob(pattern):
                findings.extend(self.check_file(str(file_path)))

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scanner.py (reported line 57)May include surrounding context.

python
'name': '敏感文件读取',
            'patterns': [
                r'open\s*\(\s*["\'](?:\.env|config\.(?:json|yml|yaml)|id_rsa|'
                r'\.aws/credentials|\.ssh/|passwd|shadow)["\']',
                r'(?:pwd|token|secret|key|password)\s*=\s*open\s*\([^)]+\)\.read\s*\(\)',
            ]
        },

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents the skill's project information entirely in Chinese, including headings, tables, and operational notes. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is written entirely in Chinese, including the skill title, usage guidance, warnings, and FAQs, with no indication that other languages are supported. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language constraint that should be disclosed or made optional.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises execution of Python-based scanning features that imply file access, shell invocation, environment access, and possible network activity, but it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime capabilities are broader than what a reviewer or platform policy can evaluate up front, increasing the chance of unintended or abusive access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and main heading/body are written entirely in Chinese, and the file does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains its primary docstrings and all user-facing error/help text in Chinese, which imposes a specific language on users without offering a choice. The policy explicitly flags language or locale constraints when they are forced without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s docstrings, comments, and user-visible error/output messages are entirely in Chinese, which implies the skill communicates in a fixed language without offering user choice. This can violate language/locale policy when no opt-in or documented locale constraint is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file adds host reconnaissance and administration-adjacent behavior such as firewall interrogation and arbitrary host connectivity probing, which is broader than the advertised purpose of scanning third-party skills for malicious code or leaks. In an agent skill context, such capability can be abused to map the local environment, test reachability of internal systems, and expose security posture information without clear necessity.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · checkers/checkers/network_checker.py (reported line 261)May include surrounding context.

python
except FileNotFoundError:
                        # 如果都没有,尝试systemctl检查防火墙
                        try:
                            result = subprocess.run(['systemctl', 'status', 'firewalld'], 
                                                  capture_output=True, text=True, timeout=self.timeout)
                            if result.returncode == 0:
                                return {'status': 'success', 'output': result.stdout}

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Enumerating local IP addresses gathers sensitive host network information that is not justified by the stated mission of analyzing third-party skills for malicious code. In an agent environment, this can reveal internal addressing, VPN presence, or network topology clues that facilitate later lateral movement or targeted exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code accesses and returns local network interface information without any visible consent, disclosure, or minimization, creating a privacy and host-information exposure issue. Such data can be sensitive in enterprise or sandboxed environments because it may reveal internal infrastructure details unrelated to the user task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring and all user-facing messages are written only in Chinese, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring is written entirely in Chinese and presents the skill's behavior and purpose in that language only. This is a natural-language locale constraint with no opt-in, alternative language, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/checkers/file_checker.py (reported line 81)May include surrounding context.

python
# 检查是否存在不安全的权限设置
            if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/file_checker.py (reported line 81)May include surrounding context.

python
# 检查是否存在不安全的权限设置
            if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/checkers/file_checker.py (reported line 83)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/checkers/file_checker.py (reported line 305)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/checkers/file_checker.py (reported line 320)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/file_checker.py (reported line 83)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/file_checker.py (reported line 229)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/file_checker.py (reported line 244)May include surrounding context.

python
if file_stat.st_mode & stat.S_IROTH:  # 其他用户可读
                result['world_readable'] = True
            if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · checkers/checkers/file_checker.py (reported line 85)May include surrounding context.

python
if file_stat.st_mode & stat.S_IWOTH:  # 其他用户可写
                result['world_writable'] = True
            if file_stat.st_mode & stat.S_IXOTH:  # 其他用户可执行
                result['world_executable'] = True
                
            return result
        except Exception as e:

Static analysis

No suspicious patterns detected.