Security audit

企业查询助手(专业版)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a company-risk lookup assistant, but it asks for broad local file and shell authority and includes monitoring/webhook behavior without clear limits.

Review this skill before installing. Use it only in an environment where broad file access and shell execution are acceptable, configure API keys through environment variables, and avoid enabling callbacks or monitoring unless you trust the webhook destination and understand what company-risk data may be transmitted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a company-information and risk-analysis tool, but its documentation expands scope to generic file handling and command execution. This kind of scope drift is dangerous because it can cause an agent or user to grant broader filesystem and execution privileges than are necessary for the advertised purpose, increasing attack surface and enabling misuse under benign-looking enterprise-search prompts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Advertising generic system command execution in a research-oriented company search skill is a significant security risk because it normalizes shell access without a purpose-specific boundary. If an agent follows this documentation, user-controlled inputs related to company queries could be repurposed into command-execution flows, leading to local code execution, data theft, or environment compromise.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill claims broad read/write file-processing abilities that are not clearly necessary for enterprise information lookup. Unnecessary local file access can expose sensitive data, overwrite user files, or enable lateral misuse when combined with structured outputs, logs, or exported reports.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation scope is defined with broad natural-language keywords and vague scenarios instead of precise triggers. This increases the chance of over-invocation, causing the skill to activate in unrelated contexts and potentially perform external queries, monitoring setup, or local actions when the user did not intend to use this tool.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill includes callback and webhook-based monitoring behavior but does not clearly warn users that company names, risk states, or related metadata may be transmitted to external URLs. This creates a data-exfiltration and privacy risk, especially in enterprise due-diligence contexts where the queried entities themselves may be sensitive business information.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documentation advertises file write capability without clearly warning users that local files may be modified. While less severe than command execution, silent write behavior can still lead to accidental overwrites, unauthorized report generation in sensitive directories, or persistence of sensitive corporate data on disk.

Static analysis

No suspicious patterns detected.