Security audit

上下文驱动开发（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks for command execution and describes broad file, API, and automation abilities beyond its context-document purpose.

Review before installing. This skill may be reasonable if you only use it to read a project and create context Markdown files, but you should avoid letting it run shell commands, install packages, call external APIs, or modify broad parts of a repository unless you explicitly approve each action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill’s stated purpose is context/document management, but the documentation broadens it into generic file processing, API integration, and command execution. That scope expansion can cause an agent to invoke higher-risk capabilities than users would reasonably expect, increasing the chance of unintended file modification, external communication, or shell execution.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The performance table claims API calling, multi-interface aggregation, and batch automation capabilities that are not supported by the skill’s declared context-management role. Inflated or mismatched capability claims can mislead orchestration logic or users into authorizing broader operations than intended.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Advertising external API integration is unjustified for a context-document management skill and creates a pathway for unnecessary outbound data transfer. In this context, project documents may contain proprietary design, workflow, or technical-stack information, so unjustified API use raises exfiltration and privacy risks.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Presenting system command execution as a core capability without a clear need materially increases risk because the manifest already allows exec. In a development-assistant context, ambiguous prompts could be expanded into shell commands that read, modify, or delete files, or run unsafe tooling with broad project access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation language is extremely broad, covering code generation, programming assistance, debugging, testing, and deployment. In combination with allowed exec access, this broad scope makes it easier for the skill to be selected for many general development requests and then exercise more powerful behaviors than users expect from a context-management tool.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The example trigger phrases are ambiguous and generic, such as initializing a project or ensuring AI consistency, without defining operational boundaries. In agent ecosystems, vague triggers can over-route normal development tasks into a skill with exec capability, increasing the chance of unintended file or system actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The description advertises file handling, API integration, and command execution without prominent user-facing warnings about their impact. Because the skill is framed as a convenience development aid, users may not realize it can touch the filesystem, send data externally, or execute commands, which is especially dangerous in source repositories containing secrets or sensitive project context.

Static analysis

No suspicious patterns detected.