代码委派工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed code-delegation helper, but it recommends running a local coding CLI with permission checks bypassed and raw command templates that can modify files broadly.

Review this skill carefully before installing. Use it only in disposable or well-contained project directories, avoid repositories with secrets, do not use the bypassPermissions template unless you explicitly accept automatic file edits, and prefer pinned or isolated installation of the required CLI.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:188

Finding

Delegated CLI Execution Bypasses Permission Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 188-203
Vulnerability Type: Delegated execution with permission controls bypassed
Risk Level: High

Vulnerable Code:

bash

cd "<project_dir>" && claude -p "<task_description>" \
  --output-format text \
  --max-turns 10 \
  --permission-mode bypassPermissions

markdown

| `--permission-mode bypassPermissions` | Automatically accept file edits | Recommended |

Technical Analysis

The recommended command invokes the delegated Claude Code process with --permission-mode bypassPermissions. This removes interactive permission checks that would otherwise provide a security boundary between model-generated actions and changes to the local environment.

The document recommends project-directory isolation, but it does not technically enforce a sandbox, filesystem boundary, command allowlist, network restriction, or validation that the selected project directory excludes sensitive files. Consequently, malicious task content or malicious instructions stored in a repository could influence the delegated process while approval controls are disabled.

Attack Path

1. An attacker supplies a malicious task description or places adversarial instructions in a repository processed by the delegated CLI.
2. The Agent changes into the selected project directory and starts Claude Code.
3. The CLI processes the attacker-controlled instructions.
4. Because bypassPermissions is enabled, operations that would normally require approval can proceed automatically.
5. The delegated process modifies or deletes accessible files or performs other actions permitted by the host account and CLI environment.

Impact Assessment

Exploitation could permit unauthorized modification or deletion of project files and other files accessible to the invoking account. If the delegated CLI can execute commands or access network resources, the ...[truncated 269 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --permission-mode bypassPermissions from the command template and do not recommend it.
• Require explicit approval for file modifications, command execution, network access, and access outside the designated project.
• Run delegated sessions in an isolated container, sandbox, or disposable worktree under a dedicated low-privilege account.
• Canonicalize the project path and enforce that it remains beneath a configured project root.
• Deny access to home directories, SSH material, cloud credentials, API keys, environment secrets, and unrelated repositories.
• Apply explicit command, filesystem, and network allowlists.
• Review generated changes and command logs before applying them to the primary working tree.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:188

Finding

User-Controlled Values Are Embedded in a Shell Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 188-192
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code:

bash

cd "<project_dir>" && claude -p "<task_description>" \
  --output-format text \
  --max-turns 10 \
  --permission-mode bypassPermissions

Technical Analysis

The command template places the project directory and task description directly into a shell command. Both values are expected to originate from user requests. Although the placeholders appear inside double quotes, double quoting alone is not a safe parameterization mechanism if an implementation replaces the placeholders with raw text.

Input containing a double quote can terminate the intended argument, after which shell operators, command substitutions, redirects, or additional commands may be parsed by the shell. The document does not define validation, canonicalization, escaping, or a shell-free process invocation method. This also conflicts with the warning at line 319 to avoid concatenating user input into command-line operations.

Attack Path

1. An attacker supplies a crafted project path or task description containing quote-breaking content and shell syntax.
2. The Agent substitutes that value into the documented command template without robust argument encoding.
3. The command is passed to a shell through the exec tool.
4. The shell interprets part of the attacker-controlled value as command syntax rather than as one argument.
5. The injected command executes with the privileges and environment of the Agent process.

Impact Assessment

Successful exploitation could provide arbitrary command execution under the account running the Agent. This may allow reading, modifying, or deleting accessible files; accessing process environment variables and credentials; altering repositories; installing software; or connecting to network services. The scope is limi ...[truncated 95 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct the invocation as a shell command containing interpolated user input.
• Use a process-execution API that accepts the executable and arguments as a structured array, for example separate arguments for -p, the task description, and each option.
• Set the process working directory through the execution API rather than invoking cd.
• Resolve the requested project path to its canonical form and verify that it is a descendant of an approved root directory.
• Reject null bytes, unexpected control characters, and paths that resolve through symlinks outside the approved root.
• If shell use is unavoidable, apply platform-specific argument escaping through a vetted library and prohibit shell operators; validation alone should not replace structured invocation.
• Add tests covering quotes, command substitutions, newlines, redirects, traversal sequences, and shell metacharacters in both input fields.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:155

Finding

Unpinned Package Is Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 155
Vulnerability Type: Unpinned global third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

npm install -g @anthropic-ai/claude-code

The same unpinned installation instruction also appears at lines 74 and 286.

Technical Analysis

The installation command does not specify an audited package version or integrity value. It therefore resolves to whichever package release the configured npm registry currently serves. A global installation also makes the package available across the user's environment and may execute package lifecycle scripts with the privileges of the invoking account.

The package name is consistent with the dependency declared by the Skill, and the audited file provides no evidence that the package itself is malicious. The vulnerability is the absence of version, integrity, provenance, and installation-isolation controls, which exposes users to package compromise and unexpected future release changes.

Attack Path

1. The expected registry account, release process, registry response, or package distribution channel is compromised, or a future package version introduces unsafe behavior.
2. A user follows the Skill's recovery or setup instructions.
3. npm resolves and downloads the current unpinned release.
4. Installation scripts execute and the CLI is globally installed.
5. Malicious installation behavior or later CLI execution affects resources accessible to the installing account.

Impact Assessment

A compromised dependency could execute code during installation or whenever the installed CLI is invoked. Potential effects include alteration of user files, credential access, installation of additional components, or network communication. The scope is bounded by the privileges of the account running npm; impact is greater if the global npm configuration causes installation to run with elevat ...[truncated 14 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than resolving the latest release.
• Verify package provenance, registry origin, signatures where available, and npm integrity metadata.
• Maintain the approved version and integrity information in controlled configuration or a lockfile.
• Install the CLI in an isolated, least-privilege environment instead of globally on the host.
• Disable lifecycle scripts when compatible with the package and installation process, or review required scripts before execution.
• Use a controlled package mirror or allowlisted registry and define a deliberate process for reviewing and approving upgrades.
• Never run the global installation command with administrator or root privileges unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends bypassing permission checks to allow automatic file edits, but does not place a strong warning or mandatory approval step around that choice. In context, the skill is designed to execute local coding tasks through a command runner, so suppressing permission prompts materially weakens defense-in-depth and can lead to unauthorized or unnoticed modifications to local files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document claims dangerous permission-skipping behavior should be avoided, but its primary command template explicitly uses --permission-mode bypassPermissions. This normalizes execution with reduced safety barriers, increasing the chance that delegated code generation or modification runs with overly broad write authority and performs unintended file changes without review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description states 支持中文交互, and the document repeatedly frames the skill around Chinese interaction, but it does not offer users a language choice or explain that the skill is intentionally region- or language-specific. This can violate language/locale policy when a skill appears to force or presume a specific language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'not applicable' section excludes 运维部署管理, while the trigger conditions explicitly say the skill should be used for 开发部署. These statements give contradictory guidance about whether deployment-related work is in scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough to activate the skill for a very wide class of development, debugging, testing, and deployment requests. For a skill that exposes exec and delegates tasks to a local CLI, overbroad activation increases the probability of unsafe invocation in contexts involving sensitive repositories, destructive commands, or ambiguous user goals without adequate gating.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s own safety guidance says not to concatenate user input into command-line parameters, yet its examples build shell commands by directly interpolating project paths and task descriptions into cd and claude -p invocations. In a skill whose core purpose is to delegate arbitrary coding tasks via exec, this creates a realistic command-injection and unsafe argument-handling risk if user-controlled values contain shell metacharacters or unexpected flags.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and main overview describe a narrowly scoped code-delegation skill for local code CLI execution. The later 'core functions' section broadens this into multi-format file writing, external API integration, and information retrieval, which materially exceeds the described code-delegation purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.