Security audit

代码执行工具专业版

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad code-execution workflow that documents automatic confirmations and password forwarding, so it needs careful review before installation.

Install only if you intentionally want a powerful code-execution skill for controlled development or CI environments. Review and remove the automatic yes/password response rules, verify the external packages, restrict working directories and commands, and avoid running it with broad credentials or privileged accounts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill claims command execution is restricted to a whitelist, but the rest of the document repeatedly advertises broad code execution, PTY access, shell scripting, CI/CD automation, and arbitrary prompts. This mismatch can cause users or downstream agents to apply weaker safeguards than necessary, increasing the chance of unsafe command execution under false security assumptions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation says sensitive credentials are not exposed, yet examples show environment-based API keys and an auto-response rule that injects a password when prompted. That contradiction normalizes credential handling through interactive execution and could lead agents to disclose secrets to subprocesses, logs, or malicious prompts.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation conditions are extremely broad, covering general code generation, debugging, deployment, and development assistance. In a skill with file write and command execution capabilities, broad triggering increases the likelihood that the skill activates in ordinary requests where the user did not clearly consent to powerful execution behavior.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes batch execution, orchestration, and code/task handling without an upfront, prominent warning that it may run commands, modify files, and affect user projects. In practice, this can lead to unsafe use because operators may treat it as advisory documentation rather than an execution-capable skill.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The documented custom response rules automatically answer confirmation prompts with 'yes' and continue through interactive checks. This bypasses safety interlocks, package manager confirmations, destructive-action prompts, and trust boundaries that are specifically designed to prevent accidental or unauthorized operations.

Ssd 3

High

Confidence: 99% confidence
Finding: The auto-response rule sends a password from an environment variable whenever a process emits 'Enter password'. That creates a direct secret exfiltration path through natural-language or subprocess-controlled prompts, allowing untrusted code or commands to harvest credentials and potentially persist them in logs or remote systems.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.