仓库协作分析(专业版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

The skill is a repository analytics guide, but it gives examples that write files, push commits, use tokens, and notify Slack while also claiming no network and no writes.

Review this skill carefully before installing. Use it only if you are comfortable with an agent generating reports, writing files, potentially committing and pushing repository artifacts, and using Slack or repository tokens. Prefer a local read-only workflow unless you explicitly approve CI publication and notification, and pin any dependencies or GitHub Actions before adopting the examples.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:204

Finding

Mutable Third-Party GitHub Action Creates a CI Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:382

Finding

Unpinned Python Package Installation Permits Unreviewed Dependency Changes

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:196

Finding

Network and Write Operations Contradict the Skill's Local-Only Security Contract

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The skill chains checkout of full repository history, privileged package installation, execution of local scripts, report generation, commit/push, and external notification into a single workflow. In agentic use, this kind of end-to-end chaining increases blast radius: a simple analysis request can become environment modification, repository mutation, and external disclosure without strong intermediate consent gates.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

fetch-depth: 0
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The custom metrics feature is defined around executable query strings, which effectively opens a command-execution surface in a skill that otherwise presents itself as constrained repository analytics. Even if the document claims whitelist validation, the examples normalize arbitrary shell-like command payloads, increasing the risk of command injection, policy bypass, or unintended access beyond read-only git analysis.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly claims a strict security contract of 'no network' and 'read-only git commands', yet elsewhere documents git push, Slack notifications, package installation, and report generation. This mismatch is dangerous because users and downstream agents may trust the declared constraints and approve execution of actions that exfiltrate data, modify repositories, or expand the runtime environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The availability section states 'all data local, no network, no writes', but the skill earlier instructs users to create reports, commit/push artifacts, and send Slack notifications. Such contradictory safety claims can cause operators or policy engines to misclassify the skill as harmless while it performs state-changing and networked actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Claiming 'all data local, no network, no writes' while the same document describes token use, webhook use, file creation, commits, pushes, and notifications is a materially misleading safety statement. In an agent setting, this can directly undermine safety policy decisions and lead to unexpected external data flows or repository modifications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level description emphasizes privacy-preserving local repository analysis, but the documented workflow includes outward communication and remote publishing capabilities. This creates a trust-boundary violation: a user selecting a 'local analysis' skill may unknowingly enable network transmission of repository-derived reports or metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation/scope language is broad, keyword-driven, and maps many generic repository-analysis phrases to the skill. In agentic environments, overbroad triggering can cause the skill to activate in contexts where the user did not intend CI changes, report generation, or broader repository inspection, increasing the chance of unsafe or surprising actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples include writing reports, committing and pushing to a repository, and sending Slack notifications, but the skill does not present a clear up-front warning that these are modifying and networked actions. This is dangerous because users may treat examples as safe defaults and unintentionally run workflows that change state or disclose repository-derived information externally.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The CI example invokes sudo apt-get update, introducing privileged execution into a skill that is ostensibly about repository analysis. While common in CI, privileged package-management steps expand the attack surface, can alter the runner environment, and become risky if reused outside tightly controlled ephemeral runners.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The sudo apt-get install -y jq step performs privileged package installation, which is inconsistent with a supposedly low-risk analysis skill. In less controlled environments, this can modify the host, introduce supply-chain risk, and normalize running elevated commands copied from documentation.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

- name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
        run: |

Static analysis

No suspicious patterns detected.