Telegram身体扫描工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.4

Overview

This skill has a coherent body-scan purpose, but it asks for broad read/write/command authority and sends sensitive body-scan media through an external service with under-specified privacy and retention details.

Review carefully before installing. Only use this skill where users understand that body-scan videos and measurements may be processed by AnthroVision, and prefer a version that removes read/write/exec, documents retention and deletion, and narrows the instructions to the body-scan bridge workflow only.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27

Finding

Excessive Agent Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–30 and 312–314
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

The document also advertises these capabilities at lines 312–314:

markdown

- **File processing**: Supports reading, parsing, and writing multiple file formats
- **API integration**: Integrates external services through standardized interfaces and processes responses
- **Command execution**: Executes system commands in a secure sandbox and collects results

Technical Analysis

The declared workflow validates body-scan inputs, obtains user consent, submits a video through anthrovision_bridge_submit_scan, polls it through anthrovision_bridge_check_scan, and formats the resulting measurements. General-purpose filesystem read/write access and system command execution are not required for those operations.

Requesting read, write, and especially exec therefore violates least privilege and unnecessarily enlarges the Skill's security boundary. Textual guidance stating that commands should run in a sandbox does not itself enforce isolation, command allowlisting, filesystem boundaries, or argument validation.

No command that directly exploits these permissions is included in the reviewed file. The risk arises from granting unrelated ambient capabilities that could be invoked if the agent is influenced by malicious user input, compromised external content, unsafe bridge output, or a subsequent modification of the Skill instructions.

Attack Path

1. An agent platform loads the Skill and grants the declared read, write, and exec tools.
2. The agent receives attacker-controlled conversation content or processes untrusted content associated with a scan request.
3. That content induces the agent to invoke one of the broadly authorized tools outside the legitimate body-scan workflow.
4. The read ...[truncated 1217 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic tool declaration:

   yaml

   tools:
     - read
     - exec
     - write
   

2. Grant only the workflow-specific bridge operations:

   • anthrovision_bridge_submit_scan
   • anthrovision_bridge_check_scan

3. If remote video retrieval is required, expose a narrowly scoped fetch operation rather than shell execution. Enforce:

   • HTTPS only.
   • Public destination addresses only.
   • DNS resolution and redirect revalidation.
   • Blocking of loopback, link-local, private, metadata-service, and reserved address ranges.
   • File-size, media-type, redirect-count, and timeout limits.

4. Enforce restrictions at the agent-platform or sandbox layer rather than relying on natural-language instructions.

5. If any command execution is genuinely required in a future version, use a fixed command allowlist, structured arguments without shell interpolation, a dedicated low-privilege identity, a read-only filesystem, an empty or minimized environment, disabled outbound networking, and strict CPU, memory, and execution-time limits.

6. Remove generic claims of file processing and command execution from lines 312–314 unless those capabilities are necessary and backed by enforceable controls.

7. Add automated policy tests that fail packaging or deployment when undeclared or unnecessary tools are requested.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill processes highly sensitive body videos and derived measurements through an external bridge service, yet the top-level description does not prominently warn users that their media and biometric-like measurements leave the local chat context. In this context, missing privacy disclosure is especially dangerous because the data is intimate, potentially identifying, and subject to consent and regulatory expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is a Telegram body-scan workflow, but this section advertises unrelated capabilities such as vulnerability scanning, CVE correlation, compliance auditing, and threat-intelligence subscriptions. That mismatch can mislead an agent or operator into granting broader trust, permissions, or usage patterns than necessary, increasing the risk of unsafe tool invocation and scope creep.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The visible skill name, summaries, and description are written entirely in Chinese, and the document consistently instructs behavior and outputs in Chinese without indicating that users may choose another language. This creates a locale/language constraint that is not presented as optional or region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document says local file paths must be rejected, but later guidance discusses local file existence, path spelling, and permission troubleshooting. These contradictory instructions can weaken enforcement of the no-local-files policy and create ambiguity that leads an agent or operator to process unintended local resources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The feature list claims generic file processing and system command execution, which exceeds the stated body-scan use case. In an agent setting, overstating capabilities can encourage unnecessary access to read/write/exec behaviors and make it easier for downstream instructions to justify dangerous operations unrelated to the intended workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The core behavior says only public HTTPS video URLs are acceptable and private/local addresses must be blocked, yet later troubleshooting text reads like a generic networked tool with broad connectivity and proxy concerns. While not code, this documentation dilutes the stated constrained intent and can mislead users about accepted data sources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.