能力扩展工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.4

Overview

The skill appears to be a knowledge-retrieval helper, but it asks for broad file and shell authority and includes unsafe token-handling guidance.

Install only if you are comfortable granting this skill broad local file and shell capabilities despite its retrieval-focused purpose. Do not paste secrets into prompts, do not run the token echo example with a real token, and prefer a host configuration that limits this skill to a scoped HTTPS query tool and redacts credentials from logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:97

Finding

Access Token Exposed Through Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 97–99
Vulnerability Type: Credential exposure through plaintext output
Risk Level: Medium

bash

export KNOWLEDGE_TOKEN="your-access-token"
echo $KNOWLEDGE_TOKEN

Technical Analysis

The setup instructions explicitly print KNOWLEDGE_TOKEN to standard output. Although the example uses a placeholder, users following the documented sequence after assigning a real token will disclose that credential in plaintext.

Standard output may be retained in terminal scrollback, shell-session recordings, CI/CD logs, Agent execution transcripts, remote support sessions, or observability systems. Environment-variable storage does not protect a credential once its value is printed.

Attack Path

1. A user assigns a valid service credential to KNOWLEDGE_TOKEN.
2. The user or Agent follows the setup instructions and executes echo $KNOWLEDGE_TOKEN.
3. The complete credential is written to standard output.
4. Terminal output is retained in an Agent transcript, execution log, recording, or monitoring system.
5. An unauthorized party with access to that output extracts the token.
6. The party reuses the token against the associated knowledge service until it expires or is revoked.

Impact Assessment

An attacker could obtain the privileges granted to the exposed knowledge-service token. Depending on server-side authorization, this may permit unauthorized queries, consumption of the victim's quota, access to account-scoped data, or impersonation of the token owner.

The issue does not directly provide local system privileges. Its scope is limited by the permissions, lifetime, and server-side restrictions of the disclosed token.

Remediation

View remediation

Remediation Suggestions

Remove the command that prints the token. Verify only whether the variable is populated:

bash

if [ -n "${KNOWLEDGE_TOKEN:-}" ]; then
  echo "Knowledge token is configured"
else
  echo "Knowledge token is not configured"
fi

Additional hardening measures:

• Ensure debug logs and execution traces redact authentication headers and token values.
• Use short-lived, narrowly scoped credentials where supported.
• Prevent secrets from being included in Agent responses or execution logs.
• Document an immediate token-rotation procedure for accidental disclosure.
• Prefer a platform secret manager over manual environment-variable entry when available.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Skill Declares Excessive Filesystem and Shell Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: Violation of least privilege
Risk Level: Medium

yaml

tools:
  - Read
  - Write
  - Edit
  - Bash

Technical Analysis

The stated primary purpose of the Skill is external knowledge retrieval, but its manifest declares unrestricted general-purpose file reading, file modification, and shell execution capabilities. The documentation does not define constrained filesystem locations, an allowlist of commands, or a narrowly scoped API client.

This unnecessarily expands the effect of malicious user input, prompt injection in retrieved content, or Agent reasoning errors. In a host that grants the declared tools, knowledge-service output could influence an Agent that also has authority to inspect local data, modify project files, and execute commands.

The package contains only SKILL.md, so there is no embedded script demonstrating direct exploitation. The practical impact depends on whether the hosting Agent platform grants and invokes the declared capabilities. Nevertheless, the permission declaration violates least privilege and creates an avoidable attack surface.

Attack Path

1. The Skill is installed on an Agent platform that honors its declared tool permissions.
2. The platform grants the Skill access to Read, Write, Edit, and Bash.
3. An attacker supplies a crafted query, or attacker-controlled content is returned by the external knowledge service.
4. The content attempts to induce the Agent to invoke one of the broadly available tools.
5. If the Agent follows those instructions without an independent authorization boundary, it may read local information, alter accessible files, or execute commands under the Agent process account.
6. The resulting data or command output could then be exposed through the Agent response or sent in a subsequent external request.

Impact Assessment

Successful abu ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

Apply least privilege to the Skill manifest:

• Remove Write and Edit because external knowledge retrieval does not require filesystem modification.
• Replace general Bash access with a dedicated, narrowly scoped HTTPS query tool.
• Remove Read unless a documented retrieval workflow genuinely requires local file input.
• Restrict outbound requests to an explicit allowlist of trusted HTTPS hosts.
• Reject redirects to unapproved origins and validate TLS certificates.
• Keep authorization headers inaccessible to retrieved content and redact them from logs.
• Treat all external responses as untrusted data rather than executable instructions.
• Require explicit user approval for any exceptional filesystem or command operation.
• Enforce host-level sandboxing, egress restrictions, command allowlists, and filesystem boundaries independently of prompt instructions.

A reduced manifest should expose only the minimum API capability necessary to submit a query and receive structured results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The metadata advertises code-related capability for a skill whose stated purpose is external knowledge retrieval. Over-declaring capabilities violates least privilege and may cause an agent platform or user to expose execution pathways that are unnecessary for the business function, enlarging the attack surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation does not clearly warn that user prompts and related content may be transmitted to an external knowledge service. This creates a privacy and data-governance risk because users or downstream agents may send confidential, proprietary, or regulated information off-platform without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is described as an external knowledge retrieval tool, but the documentation later expands its scope to file processing and command execution. That mismatch can mislead users and agents into granting broader capabilities than necessary, increasing the chance of unsafe local actions or command execution under the guise of a retrieval-only tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The display name, summary, and description are entirely in Chinese, and the document continues in Chinese without indicating that the skill is China-specific or that users may choose another language. This can violate language or locale policy when a skill implicitly forces a specific language absent user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document claims the tool is stateless and non-persistent, yet elsewhere references callback-based async handling and file operations that imply state, storage, or external side effects. Inconsistent security and data-handling claims can cause users to share sensitive content under false assumptions about retention and processing behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.