Security audit

代码委派助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent code-delegation helper, but it routinely delegates local coding work with permission bypass and only optional write protection, so it needs review before installation.

Install only if you are comfortable with a delegated local AI coding CLI editing files on your machine. Use it with explicit /code-style consent, enable a real write guard or sandbox before running delegated tasks, review the exact command and target directory, and avoid using it in repositories containing secrets or sensitive data unless containment is enforced outside the skill.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims file access is restricted to the project directory, but its documented execution model uses --permission-mode bypassPermissions, which grants broad write capability and relies on an optional write-protection plugin. This creates a mismatch between stated safeguards and actual behavior, increasing the chance that an agent or delegated CLI modifies unintended files outside the project boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises built-in security/compliance protections, but the implementation guidance depends on permission bypass plus optional external safeguards. This can mislead users and downstream agents into overtrusting the skill, reducing caution around a workflow that actually expands filesystem access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The auto-trigger conditions are very broad, covering most ordinary development actions such as editing files, creating directories, running tests, and refactoring. In context, this is more dangerous because those triggers can cause frequent automatic delegation to a local CLI running with bypassed permissions, expanding the chance of unintended code execution or file modification without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description ties usage to broad, everyday development needs like code generation, debugging, testing, and deployment, making invocation boundaries vague. In a skill that can invoke exec and recommends bypassed permissions, this ambiguity increases the risk of overuse in situations where users may not expect a delegated tool to gain broad local access.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly recommends --permission-mode bypassPermissions, which can grant full filesystem write capability, while only inconsistently requiring a strong warning and allowing execution even when the write-protection plugin is absent. In this context, the danger is elevated because the skill is designed to delegate coding tasks automatically, so privileged execution may occur in common workflows without robust user awareness or mandatory containment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.