Security audit

系统监控入门工具

Security checks for vulnerabilities and agentic risk

Overview

This monitoring skill has a plausible purpose, but it asks for command execution and contains broad, inconsistent instructions that could make it run outside a clear monitoring-only scope.

Install only if you want a local monitoring helper that may execute system commands. Treat it as Review-worthy: keep use limited to explicit monitoring requests, inspect or define the exact commands before running them, and enable SMTP only if you are comfortable sending alert metadata through your mail provider.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a narrow local monitoring tool, but later advertises generic file processing, API integration, information retrieval, and command execution. This capability drift can cause an agent or user to trust and invoke the skill in broader contexts than intended, increasing the chance of unauthorized file access, network egress, or misuse of exec-enabled behavior.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims that only whitelisted commands are executed and that user input is not composed into command lines, but the document provides exec-driven examples without any enforceable whitelist, validation rules, or implementation evidence. In a skill with exec permission, unsupported security claims are dangerous because downstream agents may trust them and execute commands that read sensitive local data, alter state, or enable command injection paths.

Vague Triggers

High

Confidence: 91% confidence
Finding: The activation guidance is overly broad, covering system monitoring, log analysis, alerting, and deployment management. Broad triggers can cause an agent to auto-select this exec-capable skill for unrelated operational tasks, expanding exposure to local command execution and unintended access beyond the user’s actual request.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The capability-scope keyword list is fragmented and excessively broad, which increases the likelihood of accidental activation by matching unrelated requests. For an exec-enabled skill, overbroad routing is a meaningful security issue because it can invoke privileged local operations in the wrong context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents email alerting via SMTP credentials and external transmission of monitoring data, but does not clearly warn users that system information may leave the local environment. This can lead to unintended disclosure of hostnames, resource usage, or operational metadata to third-party mail infrastructure.

Static analysis

No suspicious patterns detected.