系统监控入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.4

Overview

The skill is framed as a simple local monitoring helper, but its instructions are overbroad and inconsistent for a skill with command execution authority.

Review this before installing. It may be useful for local monitoring, but grant exec access only in a constrained environment and avoid letting it handle deployment, generic automation, or unsupported log-analysis tasks. Pin and verify dependencies, confirm what commands the agent may run, and configure history retention and SMTP recipients deliberately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:123

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:123 and SKILL.md:238
Vulnerability Type: Unpinned and unverifiable dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install psutil

Technical Analysis

The skill directs the agent to install psutil without specifying an approved version, validating cryptographic hashes, using a lockfile, or identifying a trusted package index. Dependency resolution can therefore produce different artifacts over time.

Installing a Python package may execute package-controlled build or installation logic. If the selected release or configured package index is compromised, malicious code could run under the privileges of the user operating the agent. The project contains no dependency integrity controls that would detect such a change.

The package name itself is not evidence that psutil is malicious. The vulnerability is the absence of version and artifact integrity controls around an executable third-party dependency.

Attack Path

1. An agent loads the skill and follows its environment preparation instructions.
2. The agent executes pip install psutil.
3. pip resolves the package dynamically from the environment's configured package index.
4. An attacker compromises the selected release, distribution artifact, account, index, or package-resolution path.
5. The malicious artifact is downloaded and installed.
6. Package-controlled installation or subsequently imported runtime code executes with the privileges of the agent's operating-system account.

Impact Assessment

Successful exploitation could allow arbitrary code execution within the Python installation context and with the permissions of the user running pip. Depending on those permissions, an attacker could read or modify files accessible to that user, access environment variables and local credentials, alter the Python environment, or communicate with external syst ...[truncated 209 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin psutil to a specifically reviewed version rather than allowing unrestricted resolution.
2. Store dependencies in a requirements file containing cryptographic hashes and install them with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Record hashes for every permitted distribution and update them only through a documented review process.
4. Configure and document an approved HTTPS package index. Do not permit untrusted extra indexes or arbitrary user-controlled index URLs.
5. Install the dependency in a dedicated virtual environment or other isolated runtime under a nonprivileged account.
6. Run dependency and provenance scanning during release preparation.
7. Ensure the pinned version receives timely security updates, with explicit review and hash regeneration for each upgrade.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description advertises log analysis as a supported use case, while the capability matrix explicitly says log analysis is not supported. This inconsistency can mislead an agent into attempting unsupported operations, potentially causing fallback to ad hoc command execution or other unsafe behaviors.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation description is broad enough to match common operations, deployment, monitoring, and alerting requests, which can cause the skill to trigger outside its narrow intended purpose. Because the skill has exec capability, overbroad matching increases the risk of unnecessary command execution in unrelated contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description explicitly states '支持中文交互', and the document presents the skill as Chinese-interaction oriented without offering an opt-in or alternative language choice. This can violate language/locale policy when a skill effectively forces a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The '核心功能' line again presents Chinese interaction as a fixed characteristic, with no indication that users may select another language. Repetition of the locale constraint without choice strengthens the impression of a forced language policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The capability coverage section uses vague keyword triggers rather than clear task boundaries, encouraging opportunistic activation for loosely related prompts. In an agent setting, that ambiguity can route unrelated requests into a skill that can execute commands and modify local monitoring state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file claims command execution is limited to a whitelist, but the manifest grants general exec access and the skill does not define any enforceable whitelist or validation rules. This creates a false sense of safety around a powerful capability, making arbitrary or unintended command execution more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a simple single-host monitoring tool, but later expands into generic file processing, API integration, and command execution capabilities unrelated to that scope. This scope drift can cause agents or users to trust and invoke the skill for broader tasks than intended, increasing the chance of unsafe execution and privilege misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The overview states that the tool provides historical data recording, which implies persistent local storage, but the description does not clearly warn users up front that running monitoring may create and retain local data. Although storage details appear later, the behavior could affect disk usage and local data handling without an explicit warning near the feature description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill advertises email notifications but does not clearly warn in the main feature description that alert content and related metadata may be sent over the network to an SMTP server. The later dependency section mentions SMTP variables, but it does not function as a user-facing privacy or transmission warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.