能力扩展工具免费版

• Outcome: Review
• Latest audit: Aug 25, 2026 · 1:10 PM UTC
• Version: 1.0.0

Overview

This skill is meant for external technical knowledge lookup, but it asks for broad file and command permissions and may send user context to an outside service without enough scoping guidance.

Review this before installing if you work with private code, credentials, customer data, or internal systems. Use it only for public technical-reference lookups, avoid sending secrets or proprietary snippets, do not expose the knowledge token in logs or terminal output, and restrict write/exec behavior unless it is explicitly user-directed and narrowly bounded.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill presents itself as a narrow external knowledge retrieval tool, but its declared tool permissions include read, write, exec, glob, and grep. This mismatch can cause an agent or user to invoke the skill with a lower perceived risk than warranted, enabling unnecessary filesystem access or command execution beyond the documented purpose.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation claims the tool is stateless and does not store results, but later sections describe file reading, writing, and file-processing behaviors. This inconsistency can mislead operators into assuming no local persistence occurs, when the available capabilities could write sensitive retrieved data to disk or otherwise retain it.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The security section says only allowlisted safe commands should be run and user input must not be concatenated into commands, but the skill elsewhere advertises general command execution. That contradiction weakens operator expectations and increases the chance that downstream implementations will expose command injection or unsafe shell usage under the guise of normal skill behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation guidance is overly broad, suggesting use whenever coding, debugging, deployment, or similar technical work occurs. Broad triggers increase the chance that sensitive prompts, code, configuration, or secrets are sent to an external service unnecessarily, and can also cause the skill to be selected in situations where its high-risk capabilities are not needed.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The examples encourage triggering external queries whenever the agent perceives a generic knowledge gap or uncertainty. This ambiguity can cause excessive externalization of user prompts and context, including sensitive or proprietary material, without a clear necessity or user awareness.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill description explains that the agent can query an external knowledge service, but it does not provide a clear, prominent warning that user prompts or embedded context may be transmitted to a third-party endpoint. Without explicit disclosure, users may unknowingly expose sensitive data, code, credentials, or business information to an external service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.