聊天Agent工具专业版

• Outcome: Review
• Latest audit: Aug 20, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

This skill describes an enterprise chat platform, but it asks for broad agent authority and underspecifies how retained messages and external callbacks/webhooks are controlled.

Install only if you intend to administer this chat platform and can set strict controls for message retention, replay access, callbacks, webhooks, CRM/IM synchronization, and CLI command execution. Use environment variables or a secret manager for credentials, validate external URLs, and narrow use to chat-platform workflows rather than general coding or security tasks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest advertises the skill for code generation, programming assistance, debugging, and deployment, while the body documents an enterprise chat platform with persistence, authentication, encryption, and room management. This mismatch can cause agents or users to invoke the skill in inappropriate contexts, granting broad tools (Read/Write/Edit/Bash) to a capability set very different from what the manifest promises, increasing the risk of misuse and unsafe automation.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documentation introduces webhook-based enterprise IM integration and CRM log synchronization that are not clearly declared in the manifest. Undisclosed outbound integrations expand the data flow and trust boundary, which is dangerous because agents may send sensitive messages or audit data to external systems users did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill claims broad file processing, API integration, command execution, and information retrieval abilities beyond what is needed for a chat-platform skill. Overbroad capability claims paired with powerful tools can lead an agent to over-trust the skill and perform unrelated or risky actions, expanding the effective attack surface.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The security section says outputs do not contain sensitive credentials, yet nearby examples include tokens, client secrets, and credential-bearing connection strings in commands and configuration. This inconsistency can normalize unsafe handling of secrets and may lead users or agents to paste real credentials into prompts, logs, or generated files.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text says to use the skill for security detection, compliance audit, vulnerability scanning, and encryption protection, which is broad enough to overlap with many generic security requests. That can route sensitive security tasks into a skill whose real focus is enterprise chat operations, increasing the chance of unsafe or misleading use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill emphasizes message persistence and replay, including historical context loading, but does not provide a clear privacy warning about retention, replay scope, consent, or minimization. In a context involving finance, healthcare, and enterprise collaboration, silent retention and replay materially increase confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The request format includes a callback_url for asynchronous completion, but there is no clear warning that results or related data may be sent to an external URL. This is dangerous because it can enable unintended data egress, SSRF-like misuse, or transmission of sensitive workflow data to attacker-controlled endpoints.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.