ai-agent-helper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.4

Overview

This skill is an AI-agent design helper, but it asks for broad file and command permissions without clear boundaries or user-confirmation rules.

Review this skill before installing in any environment with sensitive files or credentials. It should be limited to a sandboxed workspace, and command execution, file writes, callbacks, and API-key use should require explicit user approval with the exact command, path, or destination shown first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:20

Finding

Excessive Filesystem and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-26
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write
  - glob
  - grep
homepage: ""

The Skill also states at SKILL.md:65:

text

| Tool execution environment | Runtime | Optional | Some Agent Loop demonstrations require exec capability to execute Python/Shell scripts |

Technical Analysis

The Skill's stated purpose is to assist with prompt engineering, task decomposition, Agent-loop design, tool selection, output parsing, and token optimization. These activities can generally be performed through text generation and do not inherently require unrestricted command execution or broad filesystem access.

Nevertheless, the Skill requests read, write, glob, grep, and exec capabilities globally. The document does not define path restrictions, command allowlists, execution sandboxing, write boundaries, or approval requirements. In particular, exec can run Python or shell commands under the hosting Agent's operating-system identity, while the filesystem tools can discover, read, and modify files accessible to that identity.

This constitutes a least-privilege violation. Although no malicious command or executable payload is embedded in the audited file, unsafe or attacker-controlled input could influence an Agent using these capabilities to perform actions outside the Skill's legitimate prompt-design scope.

Attack Path

1. A user or untrusted document supplies crafted instructions to an Agent with this Skill loaded.
2. The Skill is granted its declared read, write, glob, grep, and exec capabilities.
3. The crafted input causes the Agent to generate or follow a workflow involving filesystem inspection, file modification, or shell execution.
4. Because the Skill specifies no path boundaries, command allowlis ...[truncated 979 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, write, glob, and grep from the default tool declaration unless a specific documented operation requires them.
2. Grant tools per task rather than globally. Prompt-design and advisory operations should run without command execution or write access.
3. Restrict all filesystem access to a dedicated workspace root and reject path traversal, absolute paths outside that root, and symbolic-link escapes.
4. If command execution is retained, run it in an isolated sandbox with:
   • A strict executable and argument allowlist.
   • No inherited secrets or unnecessary environment variables.
   • Network access disabled by default.
   • Resource, runtime, and output limits.
   • A non-privileged operating-system account.
5. Require explicit user confirmation before writing files or executing commands, displaying the exact target path or command beforehand.
6. Separate demonstrations from operational behavior. Code examples should not require live execution unless the user explicitly opts in.
7. Add audit logging for filesystem writes and command execution, including the initiating request, command, working directory, and result.
8. Replace the recommendation to run with administrator privileges at SKILL.md:360 with least-privilege troubleshooting guidance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill's display name, summary, description, and most usage content are presented in Chinese, while the file does not state that the skill is region-specific or provide any opt-in or alternative language option. This can violate language/locale policy where users should be given a choice rather than having one language implicitly enforced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises exec and write capabilities near the top-level description without a prominent warning that these operations can alter the local system or repository state. In an agent setting, weak upfront disclosure can cause users or orchestrators to treat the skill as low-risk guidance while it actually enables potentially destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Documenting a callback_url without warning that results may be transmitted to an external endpoint creates a data exfiltration and privacy risk. Users may supply sensitive prompts, outputs, or intermediate artifacts without realizing the skill supports outbound delivery to third-party infrastructure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file consistently presents the skill as an AI-agent design/optimization helper, but the '付费版进阶功能' table lists capabilities like high-resolution lossless output, style presets, model fine-tuning, and commercial copyright licensing. These statements actively conflict with the surrounding intent and appear copied from a different kind of product, creating misleading documentation about what the skill does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation materially broadens the skill from agent-design guidance into generic automation over files, APIs, and shell execution, which can mislead users and downstream agents into invoking higher-risk capabilities than the skill’s stated purpose suggests. In a skill with read/write/exec tools, this scope drift increases the chance of unsafe command execution, unauthorized file modification, or unintended data handling under an overly broad interpretation of allowed behavior.

Content

No source excerpt is available for this finding.