上下文驱动开发（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.3

Overview

The skill is not clearly malicious, but it grants broad command execution and vaguely scoped automation/API/file-changing behavior for a context-documentation purpose.

Install only if you are comfortable with a development skill that may run shell commands and perform broad project automation. Keep use scoped to a trusted workspace, review any command or package installation before allowing it, and avoid sending sensitive project data to unspecified external services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

Vulnerable Code

bash

pip install requests

Technical Analysis

The skill directs users or agents to install requests without specifying an exact version or verifying a package hash. This produces a non-reproducible installation whose resolved artifact may vary over time and according to the locally configured Python package index.

The documented Python example uses only the standard-library os module, and the dependency table does not declare requests as required. The installation therefore adds supply-chain and package-installation risk without supporting demonstrated functionality. Python package installation may execute package build or installation logic with the privileges of the invoking user.

This finding does not establish that the legitimate requests package is malicious. The issue is the unnecessary, unpinned, and unverified installation instruction.

Attack Path

1. A user or agent activates the skill and follows its environment-preparation instructions.
2. It executes pip install requests.
3. pip resolves the dependency from the environment's configured package index or mirror without an exact version or hash requirement.
4. If that source or the resolved artifact is compromised or untrusted, package build or installation logic executes locally.
5. The code runs with the invoking user's privileges and can affect resources accessible to that account.

Impact Assessment

Successful exploitation through a compromised package source or artifact could execute code with the privileges of the user running pip. Potential scope includes that user's files, environment variables, project data, and network access. The instruction does not itself request administrative privileges, establish persistence, or demonstrate access beyo ...[truncated 24 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install requests instruction because the demonstrated functionality does not use that package.
2. If the dependency becomes necessary, declare it consistently in the dependency documentation and install it in an isolated virtual environment.
3. Pin an reviewed exact version and require cryptographic hashes through a locked requirements file, such as pip install --require-hashes -r requirements.txt.
4. Use an explicitly trusted package index and review transitive dependencies before release.
5. Keep the skill's required dependencies and execution permissions to the minimum necessary for its implemented functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description is so broad that it could match routine coding, debugging, testing, deployment, and general development requests. Overbroad triggering makes it more likely this skill will activate in contexts where its powerful permissions are unnecessary, increasing the chance of unintended file, shell, or network operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description advertises '支持中文交互' and the file consistently frames use in Chinese, but it does not offer a language choice or document that the skill is intentionally restricted to a Chinese-only environment. This can violate language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage scenarios rely on ambiguous natural-language prompts like initializing or adapting a project without defining safe boundaries. In a tool-using agent, ambiguous prompts can be over-interpreted into broad file inspection, command execution, or workflow changes that the user did not explicitly request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Documenting external API/service integration is unjustified for a context-document workflow skill and creates unnecessary network exposure. Even without explicit code here, such instructions can cause the agent to send project context, code, or secrets to third-party services outside the user's expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill broadens from structured context management into full-process automation, file handling, API use, and command execution. In an agent environment, this mismatch is dangerous because users may invoke the skill for innocuous documentation tasks while unknowingly enabling much more powerful actions with system and network side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes file writing, API usage, and command execution but does not present a clear upfront warning about system or data impact at the point of use. That omission is dangerous because users may treat the skill as harmless documentation assistance while it can perform actions affecting files, the host system, and external services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a context/document management aid, but the markdown expands its behavior to generic API integration and external service invocation. That scope expansion increases the chance the agent will use network-capable behaviors the user did not intend, causing data exfiltration, unreviewed outbound requests, or abuse of broader permissions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises command execution capability beyond what is necessary for context-document management. Because the skill has exec permission, vague instructions could lead the agent to run shell commands on the host, creating risks of destructive actions, credential exposure, or unintended system modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.