Security audit

代码执行工具专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a code-execution helper, but it documents broad automatic command execution, generic confirmations, password prompt automation, and detailed logging in ways users should review carefully before installing.

Install only in a disposable or tightly controlled environment. Review the external packages, disable generic auto-confirm and password prompt automation, avoid root or sudo unless absolutely necessary, restrict workdirs and commands, and configure audit logs to redact secrets and retain data briefly.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documented custom response rules automatically answer confirmation prompts and inject a password from an environment variable into interactive sessions. This defeats meaningful human approval, can authorize destructive actions, and creates a path for secrets to be consumed or exposed by untrusted commands, especially when combined with PTY-based execution and logging.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The skill claims command execution occurs in a 'safe sandbox' while elsewhere documenting root/sudo requirements and broad code/task execution. This mismatch can cause operators or agents to overtrust the environment and run dangerous commands with elevated privileges under a false security assumption.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation guidance is broad enough to trigger the skill for general coding, debugging, development, and deployment tasks, which can cause an agent to invoke execution and file-modifying capabilities in situations that only required advice. Because the skill has exec/write tools and supports CI/CD usage, ambiguous triggering materially increases the chance of unintended system-impacting actions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill advertises automatic code execution, file handling, and command execution without an up-front, prominent warning that these actions can change the system, repositories, logs, and CI/CD environments. In practice this can lead users or orchestrating agents to authorize dangerous operations without informed consent, especially given the broad automation scope described in the file.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The audit guidance captures full stdout/stderr, execution metadata, and file changes, which commonly contain secrets, tokens, personal data, proprietary code, and operational details. In a code-execution skill, comprehensive logging substantially raises the likelihood of sensitive-data collection and later disclosure through retained log files or reports.

Ssd 3

High

Confidence: 98% confidence
Finding: The automatic response rules explicitly provide a password from an environment variable to interactive prompts. In combination with PTY execution and audit logging, this creates a direct semantic path for credential misuse, accidental disclosure, or replay by untrusted commands that can solicit 'Enter password' prompts.

Static analysis

No suspicious patterns detected.