Sys Health Pro

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:42 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local system health monitor with minor scoping and dependency hygiene issues, but no hidden, destructive, persistent, or exfiltrating behavior was found.

Install this if you want a Chinese-language local system status tool. Be aware it reports host resource details, including top process names in reports, and the package should ideally pin psutil before use in sensitive or production environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: _meta.json:7
• Finding: Unpinned Third-Party Dependency Allows Mutable Installation Behavior<![CDATA[ ## Vulnerability Details **File Location**: `_meta.json`, lines 7–10 **Vulnerability Type**: Unpinned third-party package dependency **Risk Level**: Medium ### Vulnerable Code ```json "install": [ {"id": "psutil", "kind": "pip", "package": "psutil"} ] ``` ### Technical Analysis The installation metadata requests the `psutil` package without specifying an exact version or an integrity hash. Consequently, separate installations of the same reviewed Skill may resolve to different package releases. This makes the code ultimately installed and executed dependent on the state and trustworthiness of the configured Python package index at installation time. No evidence indicates that the current `psutil` package is malicious. The risk arises from mutable dependency resolution: a compromised package release, package-index compromise, or unexpectedly incompatible future version could introduce code that was not included in this audit. Python packages may execute package-controlled build or installation logic during installation and are subsequently imported by `scripts/health.py`. ### Attack Path 1. An attacker compromises the upstream package distribution channel or publishes a malicious future release through a compromised maintainer account. 2. A user installs the Skill after that release becomes the version selected by the package resolver. 3. Because `_meta.json` provides no exact version or hash, the installer retrieves the changed package without detecting that it differs from the dependency reviewed previously. 4. Package-controlled installation logic may execute during installation, and package code executes when `scripts/health.py` imports `psutil`. 5. The malicious dependency operates with the privileges of the account installing or running the Skill. This path requires compromise or abuse of the dependency supply chain; the audited project itself does not retrieve arbitrary remote scripts or contain an observed malicious payload. ### Imp ...[truncated 403 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `psutil` to an exact, reviewed version rather than allowing unconstrained resolution. - Maintain dependencies in a lock file or hash-verified requirements file using hashes generated from trusted artifacts. - Configure installation to use an approved package index and, where practical, an internally mirrored repository. - Review dependency updates before changing the pinned version and rerun security and compatibility checks. - Use isolated virtual environments and install dependencies with the minimum privileges required. - Consider generating and retaining a software bill of materials so deployed dependency versions can be verified and monitored. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase "健康检查" is very broad and can match many user requests unrelated to system monitoring, such as medical or general wellness checkups. Overly broad activation phrases can cause the wrong skill to be invoked, leading to confusing behavior or unintended access to host-level monitoring actions in contexts the user did not intend.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code presents its user-facing title, status output, alerts, and command help primarily in Chinese, while providing no option to select another language or any statement that the tool is intentionally limited to a Chinese-speaking context. That creates a natural-language locale policy concern because the skill implicitly forces a specific language without user opt-in.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The trigger list is short and lacks scope constraints, exclusions, or examples of when the skill should not activate. This increases the chance of accidental invocation from generic monitoring or health-related requests, which is especially relevant because the skill appears to operate on local system state and could expose status details or run monitoring commands without clear user intent.

Static analysis

No suspicious patterns detected.