Security audit

自动更新工具-免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is an updater that can change local files and run commands, but its triggers are much broader than updating and its callback/persistence examples are under-scoped.

Review this skill before installing. It is not clearly malicious, but it should be treated as Review because it can guide an agent to run commands, fetch remote content, modify local files, add scheduled checks, and execute callback scripts while also advertising unrelated triggers. Use it only in a test or non-sensitive project, require explicit confirmation before update/sync/rollback/callback actions, and avoid enabling cron or callback scripts unless you have inspected the exact commands.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest description advertises project management, task planning, progress tracking, and team collaboration use cases that are unrelated to an auto-updater. This scope inflation can cause the agent to invoke a skill with exec capability in contexts far beyond update operations, increasing the chance of unsafe or unintended command execution.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The trigger language expands the skill from update tasks into generic coding assistance, debugging, testing, and deployment. For a skill with read and exec permissions, this materially broadens when an agent may select it, creating unnecessary exposure to file changes and command execution outside the intended updater use case.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documented sync flow allows an `--on-change` callback such as `reload-service.sh`, which enables arbitrary local script execution as part of an update operation. Combined with remote content fetching and exec permissions, this can turn a benign config change into code execution on the host if the callback or its parameters are unsafe or attacker-influenced.

Vague Triggers

High

Confidence: 96% confidence
Finding: Overly broad trigger conditions make the skill eligible for many unrelated requests, increasing the likelihood that an agent invokes a read/exec-enabled skill when a safer non-executing skill would suffice. In skill-routing systems, mis-scoping is dangerous because it expands the attack surface and can cause unintended local command execution or file modification.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The description overlaps with common project-management requests rather than narrowly describing update operations. This can cause accidental invocation in unrelated conversations, which is risky because the skill has execution capability and can modify local files under the guise of a broadly framed assistant.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill documents update, sync, rollback, backup, and callback behaviors that modify local files and may execute scripts, but it does not present a clear upfront warning before those examples. Users or routing agents may underestimate that these operations are state-changing and potentially code-executing, raising the chance of unsafe use on sensitive systems.

Static analysis

No suspicious patterns detected.