消费级云存储-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.4

Overview

This skill is presented as a simple cloud-storage advice helper, but it requests command and file privileges that do not fit that purpose.

Install only after reviewing whether your agent will grant the declared tools. For this free advisory use case, prefer a version that removes exec/write access and unrelated database, API, and file-automation claims, or run it in a tightly sandboxed environment with no sensitive files or credentials available.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Excessive and Inconsistent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 18–21
Vulnerability Type: Excessive tool privileges and inconsistent access-control declarations
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The skill is designed to provide consumer cloud-storage recommendations and clarify synchronization or storage concepts. These advisory functions do not require shell execution, local file reading, or file modification.

Nevertheless, the configuration grants exec, read, and write capabilities. It also contains inconsistent permission declarations: allowed-tools permits only read and exec, while the separate tools list additionally declares write. Depending on how the hosting agent interprets these fields, the broader declaration may grant file-modification privileges or create ambiguous access-control behavior.

These permissions violate the principle of least privilege. If untrusted user instructions, indirect prompt injection, or another compromised instruction source influences the agent, the unnecessary tools could become an execution channel for operations unrelated to the skill's stated purpose.

Attack Path

1. An agent loads the skill and grants the tools declared in its metadata.
2. An attacker submits a crafted cloud-storage question containing instructions to inspect local files, execute a system command, or modify a file.
3. The agent incorrectly treats the embedded instructions as necessary to fulfill the request.
4. The agent invokes read, exec, or write using the unnecessarily broad permissions.
5. The attacker may obtain command output or local file contents, or cause unauthorized local file changes, subject to the host agent's sandbox and operating-system permissions.

No malicious command is directly embedded in the audited file; exploitation depends on ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write because the documented advisory workflow does not require tools.
2. Keep a single authoritative tool-permission declaration to prevent parser-dependent privilege differences.
3. If a future feature genuinely requires filesystem access, grant only the specific operation needed and restrict it to an explicitly approved directory.
4. If command execution becomes necessary, use a fixed command allowlist, prohibit shell interpretation, pass arguments as structured arrays, and never concatenate user-controlled input into commands.
5. Require explicit user confirmation before any state-changing operation.
6. Run the skill in a sandbox with minimal filesystem access, no inherited secrets, restricted network access, and a low-privilege operating-system identity.
7. Add automated validation that rejects conflicting tool declarations and flags permissions unsupported by documented functionality.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest presents the skill as a narrow consumer cloud-storage advisory tool, but the metadata and declared capabilities expand it into database operations, file handling, API usage, and command execution. This mismatch is dangerous because agents or users may grant the skill broader trust and permissions than its stated purpose warrants, enabling unexpected access paths and abuse of exec/write features under a misleading benign cover.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation claims the free version only explains concepts and offers recommendations, but later markets full-process automation, file operations, API calls, and command execution. This contradiction is dangerous because it obscures the real privilege level of the skill, defeating informed consent and making risky capabilities appear incidental or hidden behind a harmless support persona.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A free-tier cloud-storage selection FAQ assistant has no legitimate need to execute commands, call external APIs, or write files, yet the skill advertises all three. These capabilities materially increase the attack surface: a prompt-injected or repurposed workflow could run local commands, exfiltrate data through API calls, or modify files despite the skill's ostensibly informational role.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states "支持中文交互", and the file consistently presents the skill as Chinese-only, but it does not offer opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking region or audience. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Overly broad trigger text can cause the skill to activate outside its intended consumer cloud-storage FAQ niche, especially in agent ecosystems that route tasks by semantic matching. In the presence of unnecessary exec/write capabilities, accidental or malicious over-invocation becomes more dangerous because unrelated tasks may be handled by an overprivileged skill.

Content

No source excerpt is available for this finding.