AgentVibes内容技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.4

Overview

The skill is a content/API wrapper but asks for broad file access and command execution, with weak boundaries and advice to run as administrator if permissions fail.

Review this skill carefully before installing. It may be useful for AgentVibes content generation, but only use it in a sandboxed workspace with non-sensitive files, avoid elevated/admin execution, and require explicit confirmation before any file writes, command execution, or publication to external platforms.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Overprivileged Filesystem and Command-Execution Tool Declaration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-18
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Complete vulnerable configuration:

yaml

tools:
- read
- exec
- write
- glob
- grep

Technical Analysis

The skill declares arbitrary command execution together with broad filesystem discovery, reading, and writing capabilities. Its stated primary purpose is content creation and external API integration, but the documentation does not establish why unrestricted access to all five tools is necessary.

Although SKILL.md:247 claims that only allowlisted commands should be executed, the project contains no command allowlist, path restrictions, argument validation rules, or executable implementation that enforces this claim. The project consists solely of SKILL.md.

If the hosting agent grants the declared tools without additional sandbox controls, untrusted task content could induce the skill to search for files, read sensitive information, alter workspace resources, or invoke system commands. The severity and reachable scope depend on the permissions and sandboxing supplied by the host platform.

Attack Path

1. A host loads the skill and grants the tools declared in SKILL.md.
2. An attacker supplies crafted content or instructions during a content-generation workflow.
3. The instructions induce the agent to use glob or grep to discover files and read to inspect them.
4. The agent may use write to alter accessible files or exec to invoke commands.
5. Any resulting access occurs with the filesystem and operating-system privileges of the hosting agent process.

This path is conditional on the agent treating untrusted instructions as actionable and not independently enforcing tool, command, and path restrictions.

Impact Assessment

Potential impact includes:

• Reading files accessible to the agent process.

...[truncated 448 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, write, glob, and grep unless a documented workflow strictly requires each tool.
2. Prefer a minimal declaration containing only the tools needed for content creation.
3. If file access is required, restrict operations to an explicit workspace directory and deny traversal, absolute paths, symbolic-link escapes, and access to credential locations.
4. If command execution is indispensable, replace general shell access with narrowly scoped operations or a fixed executable allowlist.
5. Pass command arguments without shell interpretation and reject shell metacharacters, command substitution, redirection, and pipelines.
6. Require explicit user confirmation before file modification or command execution.
7. Enforce resource limits, timeouts, output-size limits, and sandbox isolation at the host level.
8. Document the exact legitimate purpose and boundaries of every requested tool.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:262

Finding

Generic Recommendation to Run with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:262
Vulnerability Type: Unsafe privilege-escalation guidance
Risk Level: Medium

Complete table row, rendered in English:

text

| Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator |

Technical Analysis

The troubleshooting guidance recommends running as an administrator whenever the current user lacks read or write permission. This bypasses least-privilege boundaries rather than identifying and granting only the specific permission required for the intended workspace resource.

The recommendation is especially risky because the same skill declares command execution and broad filesystem tools at SKILL.md:13-18. Relaunching the hosting agent with administrator privileges could expand those tools from workspace-level access to access over system files and privileged operations.

This is user-mediated escalation guidance rather than an automatic privilege-escalation exploit: the documentation cannot elevate privileges by itself, and successful elevation still requires the user or operating system to authorize it.

Attack Path

1. A file-processing or command operation fails because the agent lacks permission.
2. The user follows the documented troubleshooting recommendation and relaunches the agent with administrator privileges.
3. The skill retains access to its declared read, write, discovery, and exec tools.
4. A mistaken command or malicious instruction is processed while the agent is elevated.
5. The resulting operation executes with the elevated privileges granted to the host process.

Impact Assessment

Depending on the operating system and host configuration, the elevated process could obtain:

• Read or write access to privileged files.
• Permission to modify system or application configuration.
• Ability to execute commands with administrator-level ...[truncated 219 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic instruction to run the agent as an administrator.
2. Direct users to identify the exact file or directory causing the permission failure.
3. Grant narrowly scoped read or write access only to the required workspace resource.
4. Abort the operation when it would require access to protected system resources unrelated to the documented task.
5. Recommend running the agent under a dedicated, unprivileged account.
6. Keep filesystem and command execution inside an operating-system sandbox or container.
7. Require explicit warning and confirmation if an exceptional workflow genuinely requires elevated privileges.
8. Document how users can restore any temporary permission changes after the operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

System command execution is not justified by a content-generation/API-wrapper use case and creates a direct path to arbitrary local actions if the skill is misused or prompt-influenced. In this context, exec is especially dangerous because the skill also advertises broad automation behavior, making privilege expansion easier to hide behind normal content workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation trigger is broad and ambiguous, which increases the chance that the skill is selected in contexts where users did not intend external API use or expanded capabilities. Because the skill can read, write, and execute commands, accidental invocation meaningfully raises the risk of unauthorized actions or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says the skill wraps external APIs but does not clearly warn that user prompts and context may be transmitted to third-party services. This can lead to unintended disclosure of sensitive or proprietary content, especially when the trigger is broad and users may not realize external processing is happening.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest declares read, write, and exec tools but the user-facing description does not explicitly warn about file modification and command execution. This hidden capability gap is dangerous because users may authorize a benign-seeming content skill that can actually alter local files or run commands on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest focuses on generating marketing copy, writing assistance, and content creation through API calls. Multi-tenant administration and permission management are administrative platform capabilities that are not an obvious or necessary part of a content-generation skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes generating and optimizing content, not publishing it to external platforms. Auto-publication to social media or other services is a distinct capability with broader operational impact than the stated content-creation use case.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is ներկայացված as a content/API wrapper, but the documentation later claims file processing and command execution capabilities. This mismatch materially expands the effective attack surface because users and orchestrators may invoke the skill expecting low-risk content handling while it can perform host-level actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document says the skill currently supports only English and Simplified Chinese, which imposes a locale/language constraint in natural language. The file does not present this as a user-selectable option or explain a clear region-specific compliance reason, so it may violate language-choice policy expectations.

Content

No source excerpt is available for this finding.