聊天Agent工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.3

Overview

This skill mostly describes a temporary chat room, but its instructions expand into unrelated automation uses and understate public exposure risks.

Review before installing. Use this only for temporary chat coordination, avoid treating room messages as trusted instructions, use strong one-time secrets, prefer local-only mode unless a tunnel is necessary, and do not rely on the unrelated file/API automation claims without separate verification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:287

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:287
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| uv | Package manager | Required | `pip install uv` |

Technical Analysis

The installation instruction retrieves uv from the Python package index configured in the user's environment without specifying an exact version or validating an integrity hash. Consequently, the installed artifact is mutable and may differ from the version originally reviewed.

This creates a supply-chain risk if the upstream package, package repository, configured mirror, or local package-index configuration is compromised. Installation-time behavior from a malicious package release could execute with the privileges of the user running pip.

The audit found no evidence that uv is currently malicious. The confirmed weakness is the absence of dependency pinning and integrity verification.

Attack Path

1. An attacker compromises the upstream package distribution channel, a configured package mirror, or package-index resolution.
2. The attacker publishes or serves a malicious package artifact under the expected package name.
3. A user or Agent follows the Skill instruction and executes pip install uv.
4. pip resolves and downloads the attacker-controlled mutable release.
5. Malicious installation or package code executes under the invoking user's account.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Depending on that user's access, this may expose project files, environment variables, credentials, and other user-readable data, or permit modification of user-writable files. The documentation does not request elevated privileges, so administrative or root-level impact is not established.

Remediation

View remediation

Remediation Suggestions

• Pin uv to a specifically reviewed version instead of installing the latest available release.
• Use a lockfile or requirements file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
• Explicitly identify and enforce a trusted package index rather than relying on ambient pip configuration.
• Verify package provenance or signatures where supported.
• Perform installation in an isolated, least-privileged environment.
• Document a controlled dependency-update and security-review process.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:169

Finding

Predictable Password Used in a Public Tunnel Example

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:169
Vulnerability Type: Weak authentication credential in a copy-ready public exposure example
Risk Level: Medium

Vulnerable Code Snippet:

bash

chat-agent serve --password prod456 --tunnel cloudflared

Technical Analysis

The example combines public Internet exposure through Cloudflare Tunnel with the short and predictable password prod456. Users may copy this command directly, resulting in a publicly reachable chat room protected only by a weak credential.

The documented free edition does not provide enterprise authentication, OAuth, SSO, or fine-grained authorization. Anyone who discovers the tunnel URL and guesses or otherwise obtains the password may be able to join the room. Although the document elsewhere recommends stronger passwords, this insecure public-tunnel example conflicts with that guidance.

No implementation is included in the project, so authentication rate limiting and resistance to online guessing could not be verified.

Attack Path

1. A user copies the documented command and starts the chat service with --tunnel cloudflared.
2. Cloudflare Tunnel makes the room reachable from the public Internet.
3. An attacker discovers or receives the generated tunnel URL.
4. The attacker guesses the predictable prod456 password or obtains it from copied configuration, logs, shell history, or shared documentation.
5. The attacker authenticates to the room.
6. The attacker reads available communications or submits messages while impersonating a participant.
7. If connected Agents treat room messages as trusted instructions, attacker-supplied content may influence their downstream actions.

Impact Assessment

Exploitation may permit unauthorized access to chat content available during the room's lifetime and unauthorized message injection. The affected scope includes participating users and Agents in that room. Injected mes ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the literal password with runtime generation of a unique, cryptographically random secret of sufficient entropy.
• Do not place reusable credentials directly in command-line examples because command arguments may also be retained in shell history or exposed through process inspection.
• Accept the secret through a protected environment variable, restricted file, or interactive prompt.
• Add authentication rate limiting, exponential backoff, and temporary lockout controls.
• Prefer stronger authentication for publicly reachable deployments and restrict tunnel access where possible.
• Clearly instruct users to rotate the secret for every room and stop the service immediately after use.
• Require connected Agents to treat all room messages as untrusted input and independently authorize any sensitive action requested through chat.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions instruct use for file processing, document conversion, and content extraction, which directly contradict the skill’s stated chat/communication purpose. In an agent setting, misleading triggers are dangerous because they can cause the model to select this exec-capable skill for unrelated tasks, potentially exposing files or running commands under false pretenses.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger guidance is both vague and inconsistent with the skill’s actual purpose, encouraging invocation for unrelated tasks. Because the skill permits exec and browser/read tools, poor trigger quality can materially increase the risk of accidental misuse, over-broad command execution, and unintended data access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as a temporary chat tool, but later claims unrelated file-processing, API integration, and general automation capabilities. This scope inflation can cause an agent to invoke the skill in contexts it was not designed for, increasing the chance of unsafe command execution or data handling beyond the user’s intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly states '支持中文交互', and the document consistently presents the skill as Chinese-only without offering the user a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document markets the service as memory-only, disposable, and zero-maintenance, but also promotes tunnel exposure and external tunnel dependencies that send traffic through third-party infrastructure. This can mislead users into underestimating privacy, exposure, and operational risks, especially when the chat is reachable from the public internet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill recommends exposing a locally hosted chat service through cloudflared or ngrok without a prominent warning about public reachability, brute-force risk, metadata leakage, or the danger of sharing sensitive content over a temporary password-protected channel. In context, this is more dangerous because the tool is meant for multi-agent and human collaboration, making accidental exposure of operational data plausible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.