结构化开发工具免费版

• Outcome: Review
• Latest audit: Aug 22, 2026 · 1:58 AM UTC
• Version: 1.0.4

Overview

This skill appears to be a coding workflow guide, but its instructions are inconsistent about command execution, network/API use, credentials, and local persistence.

Review this skill carefully before installing. It is not clearly malicious and no executable payload was present, but users should only enable it in an agent environment where file writes, shell commands, API credentials, and network access remain under explicit user control. Treat its offline-only and no-API-key claims as unreliable unless the publisher clarifies the documentation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill presents contradictory execution semantics: one section says it does not automatically execute code, while later sections advertise automation and system command execution. This can mislead users and host agents into granting broader trust or permissions than intended, increasing the risk of unsafe local command execution.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill claims to be fully local and not to make network requests, but elsewhere references API usage, external service calls, credentials, and TLS-secured communication. This inconsistency is dangerous because operators may expose secrets or allow connectivity under the false assumption that the skill is offline-only.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document first says no extra API key is required, then later instructs users to configure API keys or credentials. Contradictory credential requirements can cause users to unnecessarily provision secrets to a skill whose actual behavior is unclear, expanding the blast radius if the skill later invokes external services.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill says it only provides guidance and does not auto-execute, yet another section markets it as fully automated. This creates a trust mismatch that may cause users or orchestrators to underestimate the operational effects of enabling the skill, especially in environments with file and shell capabilities.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill defines a very broad activation scope across generic development scenarios without clear exclusions. In agent ecosystems, overbroad matching can cause the skill to activate in unrelated contexts and influence tasks involving code, files, shell usage, or user preferences beyond what the operator expected.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The supported-keyword list is excessively broad and lacks exclusion conditions, making accidental invocation likely. In combination with Read/Write/Edit/Bash tool access, an overly permissive trigger surface can expand the skill's influence over sensitive development tasks and local state changes.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill describes local preference and checkpoint storage but does not clearly warn, up front, that it writes to files under $HOME/code/. This can lead users to unknowingly persist potentially sensitive preferences, task history, or project metadata on disk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.