Security audit

代码委派基础版

Security checks for vulnerabilities and agentic risk

Overview

This is a code-assistant skill with expected read and command capabilities, but it describes broad command, file-writing, and external API behavior without enough clear scoping or user control.

Review this skill before installing. It is not malicious from the inspected artifacts, but it should only be used where a programming assistant is allowed to read project files and run commands, and users should require explicit approval before command execution, file changes, or any external API/network activity.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill manifest declares a narrow code-delegation capability with only read and exec tools, but the documentation later expands scope to generic file handling, API integration, and command execution. This mismatch can mislead users and orchestrators about what the skill may attempt, increasing the risk of over-broad invocation and unsafe operations under a trusted programming-assistant label.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation language is so broad that it overlaps with ordinary programming, debugging, and deployment requests, which can cause the skill to trigger in many contexts without users realizing they are invoking a tool-enabled workflow. In a skill that includes exec permission, over-broad routing raises the chance of unnecessary command execution or handling of sensitive code and environment data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description explicitly states '支持中文交互' as part of the skill behavior, and the document does not offer language selection or explain that the skill is intentionally limited to a Chinese-only context. This creates a natural-language policy concern because it appears to enforce a locale/language preference without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document says no extra API key is needed, while elsewhere describing external API integration and HTTPS communication. This inconsistency can cause users to misunderstand whether external services are involved and whether secrets or data may be transmitted off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The markdown describes file-processing behavior that implies possible modification or merge-back into user code, but it does not clearly warn users about the risk of changing local files or generated output being applied to source code. In a programming skill, silent or ambiguous write-like behavior can lead to codebase corruption or unintended sensitive-file changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill is marketed as a limited 'basic version' but later claims broad automation, error recovery, security checks, file operations, API integration, and command execution as core features. This creates an unsafe trust boundary: users may underestimate the breadth of actions the skill may take and fail to apply appropriate review before use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill claims it can integrate with external APIs even though its declared tools do not provide network access. Such false capability claims are dangerous because they encourage users to provide sensitive inputs or rely on behavior the platform cannot enforce or audit as described.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation advertises command execution and external API/network usage without clear, upfront warnings about system impact, outbound data exposure, or privacy implications. In a code-assistant context, this is especially dangerous because users may supply proprietary code, credentials, or internal paths expecting local-only assistance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.