Security audit

内容验证网关免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local content-checking helper, but it grants command execution and includes unsafe examples that can expose or persist sensitive content.

Review this skill carefully before installing. Use it only in a constrained workspace and avoid submitting secrets or confidential drafts unless the examples are hardened first. The publisher should narrow activation to content-validation requests, remove raw content samples and previews from outputs/logs, require explicit consent before writing files, and replace the unsafe shell/Python snippets with fixed-string handling and safe argument passing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:308
Finding: Python Code Injection Through an Interpolated File Name
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:134
Finding: Regular-Expression Injection in Rule Removal
Content: View full analysis
Remediation: View remediation
None: path = approved_files.get(file_name) if path is None: raise ValueError("Unsupported rule file") lines = path.read_text(encoding="utf-8").splitlines() retained = [line for line in lines if line != term] path.write_text("\n".join(retained) + "\n", encoding="utf-8") ``` Also: - Permit only explicit rule-file names. - Reject control characters and embedded newlines in terms. - Write updates atomically through a securely created temporary file. - Apply restrictive permissions to rule files. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:292
Finding: Unsafe Dynamic Sed Program in Sensitive-Content Redaction
Content: View full analysis
/dev/null) CONTENT=$(cat "$INPUT_FILE") FILTERED="$CONTENT" for term in $BLOCKLIST; do FILTERED=$(echo "$FILTERED" | sed "s/${term}/***REDACTED***/gi") done echo "$FILTERED" > "$OUTPUT_FILE" ``` ### Technical Analysis Each blocklist term is inserted directly into a dynamically constructed `sed` substitution expression. The terms are therefore treated as regular expressions and `sed` program syntax rather than literal strings. A malformed or attacker-controlled term can: - Match more content than intended. - Fail to match the intended literal content. - Break the generated `sed` expression. - Cause redaction to fail or corrupt the output. - Trigger excessive regular-expression processing with complex patterns. The loop `for term in $BLOCKLIST` also performs shell word splitting and glob expansion. Rules containing spaces cannot be handled as single entries, while wildcard characters can expand against file names in the current directory. These behaviors make the security filter dependent on ambient filesystem contents and allow straightforward redaction bypasses. ### Attack Path 1. An attacker adds or causes the use of a blocklist entry containing whitespace, glob characters, regular-expression metacharacters, or a `sed` delimiter. 2. The shell splits or expands the entry during `for term in $BLOCKLIST`. 3. The resulting value is embedded into the `sed` substitution program. 4. The substitution either targets unintended content, fails, or processes a different value from the original rule. 5. Sensitive content remains unredacted or unrelated content is corrupted. 6. The generated output may then be treated as safe and published or logged. ### Impact Assessment The primary impact is failure of a security control. Sens ...[truncated 298 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:197
Finding: Sensitive Values Exposed in Classification Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:225
Finding: Unredacted Content Previews Written to Persistent Logs
Content: View full analysis
> "$LOG_FILE" } ``` ### Technical Analysis The function stores `content_preview` directly in a persistent log. Because the skill processes potentially sensitive content, the preview can include credentials, identity information, financial data, or other prohibited material. The implementation does not set restrictive file permissions, redact the preview, define a retention period, or prevent other local users from reading the file. The process umask determines the final permissions. Untrusted content can also contain newline or control characters. Because it is appended without encoding or sanitization, an attacker can forge additional log records, alter apparent verification results, or disrupt tools that parse the log line by line. ### Attack Path 1. An attacker submits content containing a secret or crafted newline-separated text. 2. The content or part of it is passed as `content_preview`. 3. The function appends the value without redaction or encoding. 4. The secret persists in the daily log, or the embedded newline creates forged log entries. 5. A local user, later agent session, backup process, or log collector accesses the exposed value or trusts the forged record. ### Impact Assessment The issue can disclose any sensitive data included in previews and can undermine the integrity of the verification audit trail. It does not itself elevate operating-system privileges, but disclosure may expose credentials that provide access to other systems. The persistence scope is ...[truncated 91 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation language is excessively broad and overlaps with routine developer requests such as programming help, debugging, testing, and deployment. This makes accidental invocation much more likely, especially because the skill has exec permissions, increasing the risk that users trigger local command execution under a misleadingly benign content-audit label.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest frames the skill as a content-audit tool, but the activation text is broadened to code generation, debugging, testing, and deployment workflows. In an agent ecosystem, this expands when the skill may be auto-invoked and can expose users to command-execution behaviors outside the narrow safety-review purpose they would reasonably expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description explicitly states '支持中文交互' as part of the skill behavior, and the document is framed around Chinese interaction without presenting language choice or opt-in at activation. This can violate language/locale policy expectations when users have not chosen Chinese as their preferred interaction language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The free-vs-pro comparison explicitly states that the free version does not support real-time monitoring. Yet the top-level '核心功能' text says the skill provides '化工作流场景等能力', and elsewhere the document overstates broad capabilities; the clearest contradiction is the free-tier limitation versus later generalized capability claims that blur edition boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The verification logging function stores raw content previews in local log files, which can include sensitive user-provided data such as credentials, personal information, or proprietary text. Because this skill is specifically designed to inspect potentially sensitive content, logging previews creates a realistic secondary leakage channel and expands data retention without clear user warning or minimization.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Storing natural-language content previews in verification logs creates a direct data leakage path for exactly the kinds of sensitive inputs this tool is meant to inspect. This is especially dangerous in the skill context because users may send secrets, personal data, or confidential drafts for screening, and the logging behavior increases persistence and discoverability of that data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The filtering workflow rewrites user content into a new local output file, persisting transformed versions of potentially sensitive input without an explicit warning. In a content-screening skill, silent file creation/modification can surprise users, leave recoverable copies on disk, and broaden exposure of sensitive material to other local processes or users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Lines L396-L397 state that the free version is purely local and does not send content externally. Later, the security section discusses network communication safety, HTTPS, and SSL certificate validation, which directly implies networked behavior inconsistent with the earlier documented intent for this edition.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises broad file handling, API integration, and system command execution beyond what is necessary for basic local content validation. In the context of an agent with exec access, unnecessary capability breadth increases the chance of unsafe actions, misuse of local files, and over-collection or modification of user data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest and main description consistently position the skill as a local AI-generated content validation tool with blacklist/allowlist management, classification, and basic policy enforcement. However, the later '核心功能' section explicitly adds 'API集成' via external service calls, which is a materially broader behavior not justified by the stated product scope, especially since earlier text says the free version is pure local processing and does not send content externally.
Content: No source excerpt is available for this finding.