T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:19- Finding
Unnecessary Write Permission Violates the Skill's Read-Only Security Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
仓库协作分析(免费版)
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended for local Git repository analysis, but it asks for write capability and contains contradictory read-only, write-operation, and network-use statements.
Review this before installing. It may be usable for local Git analysis if the host runtime enforces read-only filesystem access and restricts exec to the documented git commands, but do not rely on the skill text alone: remove or deny write access, treat repository metadata as untrusted input, and clarify whether any network troubleshooting commands are allowed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:110- Finding
Attacker-Controlled Git Metadata Is Returned to the Agent Without Sanitization
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill repeatedly markets itself as strictly read-only and privacy-preserving, but its manifest enables the write tool and the body advertises modify/delete/save style operations. This mismatch can cause an agent or user to trust the skill with repositories or local data under false assumptions, increasing the chance of unintended file modification or destructive behavior.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation claims only whitelisted read-only git commands are used, yet nearby sections describe create/modify/delete/save/export operations through generic parameter interfaces. That contradiction weakens the safety contract and can be exploited by broad agent interpretations to perform actions outside the stated read-only boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation wording is so broad that it overlaps with generic data analysis, reporting, and visualization tasks unrelated to Git repository collaboration analysis. Over-broad routing can cause this skill to be invoked in the wrong context, granting exec/write-capable tooling to workflows that did not intend to use a local command-execution skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description explicitly states '支持中文交互' and the document presents the skill as operating in Chinese, without indicating that users may choose another language. This is a natural-language locale constraint that lacks user opt-in or documented justification as a region-specific tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The keyword-based capability coverage section defines an extremely broad trigger surface with many generic phrases, making accidental or excessive invocation more likely. In a skill that includes exec and declared write capability, weak routing boundaries increase exposure to unintended command execution and policy bypass through misclassification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The FAQ asserts there is no network activity, but other sections mention ping-based troubleshooting, HTTPS, SSL validation, and network-dependent behavior. Even if this is documentation drift rather than active exfiltration logic, it undermines operator trust and can justify unexpected outbound commands in environments where the skill is expected to remain fully local.
- Content
Static analysis
No suspicious patterns detected.