投屏控制免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.1

Overview

This Chromecast skill is mostly a command guide, but it has conflicting scope instructions and unsupported security claims that make it risky for automatic agent use.

Install only if you intend to use it for Chromecast control and can keep the agent from invoking it for database, API, or generic automation tasks. Use an isolated Python environment, review/pin the catt dependency, choose the target Chromecast explicitly, and avoid casting private files or internal URLs on untrusted networks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:177

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 177
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

| catt | Python工具 | 必需 | `pip install catt` |

Technical Analysis

The skill instructs users or an executing agent to install catt from the default Python package index without pinning a reviewed version or verifying package hashes. It also does not require an isolated environment or identify a trusted package repository.

Consequently, the code installed by this command may change after the skill has been audited. A compromised package release, package-index compromise, or unexpected upstream update could introduce malicious code. Python packages may execute code during installation through build hooks, and the installed catt executable subsequently runs with the invoking user's privileges.

This instruction also conflicts with the document's general claim that dependencies use version locking and integrity verification, because neither control is present in the actual installation command.

Attack Path

1. An attacker compromises the upstream catt project, its release credentials, or the package distribution channel.
2. The attacker publishes a malicious release that is selected by the unversioned pip install catt command.
3. A user or agent follows the skill instructions and installs the dependency.
4. Malicious code executes through package build or installation hooks, or when a documented catt command is subsequently invoked.
5. The malicious code operates with the filesystem, process, and network permissions of the user running the agent.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the invoking user's account. Depending on that account's permissions, an attacker could read or modify accessible files, access environment variables, initiate network connections, tamp ...[truncated 322 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin catt to an explicitly reviewed version rather than installing the latest available release.
2. Record dependency hashes in a requirements file and install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Install the dependency in a dedicated virtual environment or similarly isolated runtime using an unprivileged account.
4. Document the verified package identity and approved package index to reduce dependency-confusion and repository-spoofing risks.
5. Review build metadata and transitive dependencies before approving upgrades.
6. Use automated dependency and supply-chain scanning, and update the pinned version only after security review.
7. Replace the unsupported dependency-locking claim in the documentation with controls that are actually implemented.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description uses broad activation language such as productivity, automation, batch processing, and workflow optimization that is unrelated to Chromecast control. Overbroad routing criteria can cause an agent to select this Bash-capable skill for tasks outside its intended domain, raising the risk of unnecessary command execution or interaction with external devices.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The startup conditions explicitly say to use the skill for database operations, SQL queries, and storage management, which directly conflicts with its stated Chromecast purpose. In an agentic environment, such contradictory routing instructions can misdirect the tool into unrelated tasks and trigger unsafe Bash use under false assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description states '支持中文交互' and presents the skill as Chinese-interaction oriented, but does not indicate that language is optional or user-selectable. Under the language policy, forcing or assuming a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The feature note highlights '中文交互' as a core capability without clarifying that the user may choose another language. This can be read as a default language constraint rather than an optional capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill omits a clear warning that casting a URL or local file sends content over the LAN to a Chromecast device and may expose private media or internal URLs to another endpoint. Because the tool controls external hardware and may require local serving of files, users need explicit notice about network transmission and visibility implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples include stop, seek, and volume commands that directly affect external devices, but they do not warn that executing them can interrupt playback or alter volume on a physical TV or shared room device. In a multi-user or shared-device setting, this can cause unintended disruption and unsafe side effects from normal-looking example commands.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a Chromecast control tool, but the documentation also claims unrelated database/API workflow capabilities. This mismatch can cause an agent to invoke the skill in unintended contexts or apply incorrect operational assumptions, increasing the chance of unsafe command execution or inappropriate data handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file says the skill does not require API keys or cloud APIs, yet other sections describe API-key handling and HTTPS transport requirements. These contradictions can mislead operators and agents about trust boundaries, secret handling, and network behavior, causing insecure deployment decisions or improper secret provisioning.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation states that fallback/default handling and retry-with-backoff are 'already implemented', but this file only contains Markdown guidance and example commands, with no code that implements such mechanisms. This overstates actual behavior and can mislead users or agents about operational guarantees.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.