Security audit

聊天Agent工具免费版

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a temporary chat server, but its instructions also route it toward unrelated file/design tasks and public internet exposure, so it should be reviewed before installation.

Install only if you intentionally need a temporary chat room for agent or human collaboration. Configure routing so it is not invoked for file processing, design work, document conversion, or generic automation, and avoid public tunnel mode unless you use a strong unique password, trust all recipients of the URL, avoid sensitive conversations, and stop the service when finished.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill metadata and documentation contain contradictory scope statements, mixing a real-time chat service with unrelated design/creative and later file-processing claims. This can cause an agent to invoke the skill in the wrong context, grant unnecessary trust, or perform unintended actions with exec/browser-enabled tooling.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The trigger condition explicitly says the skill should be used for file processing, document conversion, and content extraction, which directly conflicts with the rest of the skill describing a temporary chat service. In an agentic system, trigger text strongly influences routing, so this mismatch can cause the wrong skill to be selected and then execute commands or open network services unexpectedly.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The efficiency analysis claims bulk file processing, file parsing, and API aggregation capabilities that are unrelated to the documented chat tool. These inflated claims can mislead operators or upstream planners into using the skill beyond its safe design, increasing the chance of unintended command execution or network exposure.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The 'core functions' section advertises file handling, API integration, command execution, and information retrieval that materially exceed the documented purpose of a temporary chat room. Overbroad capability claims are dangerous in tool-using agents because they expand when and why the skill may be invoked, and normalize use of sensitive tools like exec for unrelated tasks.

Vague Triggers

High

Confidence: 99% confidence
Finding: The trigger conditions are both overbroad and incorrect, steering the skill toward unrelated file-processing tasks. In an automated agent environment, poor trigger quality is a security issue because it causes misrouting into a skill with exec/network capabilities, which can lead to unintended service startup, tunnel exposure, or other side effects.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation encourages exposing a password-protected local chat service to the public internet via cloudflared/ngrok without strong, prominent warnings about brute force, interception of shared URLs, service abuse, metadata leakage, and lack of enterprise-grade authentication. In context, this is more dangerous because the tool is intended for quick, low-friction use, which increases the chance that users will expose it casually with weak passwords or sensitive conversations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.