Security audit

代码委派工具免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a code-delegation helper, but it normalizes broad local command execution and automatic file-edit permission bypasses that users should review before installing.

Install only if you intentionally want an agent to delegate coding work to a local Claude CLI with command execution. Use it only in a dedicated project directory, avoid permission-bypass mode unless you fully trust the repository and task, review commands before execution, and assume project contents may be sent to the external CLI provider during delegated work.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill’s safety section claims user input should not be concatenated into command-line arguments, yet the examples instruct exactly that by embedding task descriptions into shell-invoked CLI commands. This creates a realistic command/argument injection pathway or unsafe delegation path where untrusted user content is forwarded directly to an executable context.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document says dangerous permission-skipping should not be used, but the recommended command template enables bypassPermissions, which weakens or removes approval controls for file edits. In a tool that delegates code execution and modification, reducing permission barriers materially increases the risk of unintended or malicious filesystem changes.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The skill is presented as a code-delegation tool, but later claims generic file processing, API integration, command execution, and information retrieval capabilities. This scope expansion weakens operator expectations and can cause the skill to be invoked in broader, riskier contexts than intended, increasing the chance of unsafe tool use or privilege misuse.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The top-level description is broad enough to match many ordinary development requests, which can cause the skill to activate without clear user intent or adequate safety checks. For a skill with exec capability, overbroad invocation criteria increases the likelihood of unreviewed command execution in situations where safer handling would be preferable.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The dedicated trigger section says to use the skill for coding, debugging, testing, and deployment needs, which is too ambiguous for a high-risk exec-enabled skill. Ambiguous triggers increase accidental activation and can route general requests into an execution workflow without sufficient scoping or consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill recommends automatic file-edit permissions in its command template without pairing that guidance with prominent warnings about write access and modification risk. In the context of a local exec tool, normalized auto-edit behavior can lead to silent codebase changes, damaged files, or unauthorized edits to sensitive repositories.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.