Security audit

仓库协作分析(免费版)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for local read-only Git repository reports, but its metadata and instructions conflict by mentioning write access, save/delete-style actions, and network checks.

Install only if you are comfortable reviewing and constraining the skill first. Remove the write tool declaration, narrow triggers to explicit local Git repository analysis, and delete the generic create/modify/delete/save/import and network troubleshooting text before relying on its read-only privacy claims.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill repeatedly claims to be strictly read-only and zero-write, but its manifest declares `write` and the body advertises save/modify/create/delete style operations. This mismatch can cause an agent or user to grant broader permissions than necessary, enabling unintended file modification or persistence if the skill is invoked or extended incorrectly.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: These sections contradict the skill’s stated analytics-only, read-only purpose by describing create/query/modify/delete/import/save/convert behaviors. Even if no such implementation exists, this is dangerous because it broadens the apparent authority of the skill and may lead an agent to perform state-changing actions outside the user’s expected trust boundary.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The error-handling and security text introduces network-dependent behaviors such as `ping` testing and HTTPS/SSL guidance despite repeated claims of zero-network operation. This inconsistency weakens the trust model and can prompt unnecessary outbound connectivity, which is especially problematic for a privacy-focused local-analysis skill.

Vague Triggers

High

Confidence: 90% confidence
Finding: The description uses broad, generic trigger language covering common data analysis, reporting, statistics, visualization, enterprise workflows, and automation scenarios. Overbroad invocation criteria increase the chance the skill will be selected in unrelated contexts, where its `exec` capability could expose local repositories or run commands unexpectedly.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The long keyword list is fragmented and overly inclusive, which makes trigger matching ambiguous and encourages accidental activation. In the context of a skill with command-execution privileges, imprecise routing increases the risk of unintended local command execution and unnecessary exposure of repository metadata.

Static analysis

No suspicious patterns detected.