T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:156- Finding
Sensitive Environment Variable Enumeration Exposes Credentials to Agent Context
- Content
View full analysis
- Remediation
View remediation
Security audit
沟通助手基础版
Security checks for vulnerabilities and agentic risk
Overview
This communication-drafting skill is not proven malicious, but it asks for broad agent powers and includes loosely scoped API, file, command, callback, and secret-checking instructions that do not fit its stated purpose.
Review this skill carefully before installing. It may be reasonable only if you are comfortable giving a communication helper broad file, edit, shell, API, and callback capabilities. Avoid running the environment-variable checks, do not provide sensitive conversation content with callback_url unless you trust the destination, and require explicit confirmation before any file, API, or command execution.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes generic command execution and troubleshooting guidance despite its stated purpose being message drafting and tone adjustment. In a skill with Bash access, normalizing arbitrary command execution creates a pathway for unintended system actions, data access, or chaining into more dangerous operations unrelated to the user-facing function.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is presented as a lightweight communication-writing assistant, but later expands into broad file processing, API invocation, and command execution workflows unrelated to that purpose. This capability mismatch increases the chance that an agent will exercise powerful tools like Bash, Read/Write, or network-adjacent behaviors under an innocent-seeming cover story, which is a classic risk-amplifying design pattern for over-privileged skills.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The version-positioning table explicitly says the FREE version does not support batch operations. Later sections describe '批量文件处理(100个)' and '重复任务批量执行' as supported automated scenarios with quantified performance, which directly contradicts the earlier limitation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes broad natural-language triggering without precise activation constraints, making it easier for unrelated user text or context to be interpreted as an instruction to execute tool-backed behaviors. In an agentic skill with Write/Edit/Bash available, vague invocation semantics increase the risk of accidental or prompt-injected activation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill accepts a callback_url for asynchronous completion but does not warn that results may be transmitted to an external destination. Without explicit restrictions, this creates a data egress channel that could leak conversation content, metadata, or other sensitive outputs to attacker-controlled endpoints.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly instructs users to enumerate environment variables matching API, KEY, TOKEN, or SECRET, which is a secret-discovery step. Even though the example masks values, the act of probing for secrets is unnecessary for a communication assistant and normalizes credential discovery behavior that could be repurposed for exfiltration or privilege expansion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The general usage section tells the agent to automatically parse instructions, call tools or APIs, and execute operations without clearly constraining when that is allowed. This broad autonomy is risky because it can turn ordinary conversational input into operational behavior, especially in the presence of prompt injection or ambiguous user intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The display name and the entire user-facing documentation are presented in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a specific language is imposed without user choice or justification.
- Content
Static analysis
No suspicious patterns detected.