Security audit
Security checks for vulnerabilities and agentic risk
This updater skill is not clearly malicious, but it asks for command execution and describes file-changing, script-running, and scheduled update behavior with broad and inconsistent scope.
Install only if you intend to use an exec-capable updater and will review each target URL, target path, callback script, backup directory, and cron entry before running it. Avoid using this skill for general coding, project management, deployment, or collaboration prompts, and prefer manual confirmation for updates, rollback, sync, and scheduled checks.
The manifest uses vague, catch-all wording that overlaps with common project-management requests, despite the skill having exec privileges and updater functionality. In agent ecosystems, this broad matching can route many unrelated prompts into a system-modifying skill, amplifying misuse risk.
The trigger conditions include broad software-development activities such as code generation, debugging, and deployment, far beyond an auto-updater's scope. Overbroad triggers increase unintended invocation of an exec-enabled skill, raising the chance of unnecessary command execution, file changes, or network actions in unrelated tasks.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"diffOnly": true, "autoBackup": true, "onUpdate": "post-update.sh", "exclude": [".log", "tmp/", ".env"] }
The manifest description advertises broad project-management and team-collaboration use cases that do not match the documented updater behavior. This can cause the agent to invoke the skill for unrelated requests, exposing the exec-capable workflow in contexts where users did not intend system-changing update actions.
The skill describes update, backup, sync, and rollback operations that can modify local files and system state, but it does not present a clear up-front warning that these actions may overwrite data or execute follow-on scripts. In an exec-enabled skill, missing warnings reduce informed consent and increase accidental destructive changes.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 检查更新
./auto-updater check \
--current "1.0.0" \
--remote "https://api.example.com/releases/latest"
# 输出:
# 当前版本: 1.0.0
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 检查更新
./auto-updater check \
--current "1.0.0" \
--remote "https://api.example.com/releases/latest"
# 输出:
# 当前版本: 1.0.0
The sync example updates a local target file and executes an on-change callback script, but it does not warn that local files may be overwritten and arbitrary scripts may run. Because the skill has exec access, this omission materially increases the risk of unintended file replacement and command execution triggered by remote changes.
The cron example establishes persistent scheduled execution for network checks and possible follow-on actions, but it does not clearly warn users that this creates an ongoing background task. Persistence increases risk because a misconfigured or later-expanded updater can continue running without fresh review.
# 添加 cron 定时检查
crontab -e
# 每天早上 9 点检查更新
0 9 * * * /path/to/auto-updater check --config /path/to/update-config.json
The file claims the free edition only notifies about updates, yet elsewhere instructs direct update, sync, backup, rollback, and command execution. This inconsistency can mislead users and higher-level agents about the skill's authority, causing unanticipated file modification or command execution.