Security audit

上下文驱动开发（专业版）

Security checks for vulnerabilities and agentic risk

Overview

This skill appears aimed at managing project context documents, but it asks for broad file and shell authority while giving inconsistent guidance about API keys and external/API use.

Review before installing. Use it only in repositories where you are comfortable with the agent creating or changing context files, and do not provide API keys, callback URLs, or credentials unless you have independently confirmed they are needed and where they will be sent. Prefer explicit, narrow prompts and ask for a dry run or file list before any writes or commands.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill’s documentation presents conflicting statements about whether it uses network/API capabilities and whether additional credentials are needed. This is dangerous because operators may incorrectly trust the skill’s execution model, approve network access they did not expect, or fail to apply appropriate secret-handling controls during use.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document first says no extra API key is required, then later instructs users to configure an API key and establish an API connection. This contradiction can lead users to provision unnecessary secrets or connect the agent to external services under false assumptions, increasing the risk of accidental credential exposure or unintended data egress.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation description is broad and ambiguous while the skill also has read/write/edit/bash capabilities. In this context, vague activation criteria can cause the agent to apply the skill in unrelated developer workflows, leading to unintended file changes or shell actions without sufficiently informed user intent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The scenario trigger phrases are generic enough that many normal development requests could match them accidentally. Because the skill advertises workspace modification and analysis behaviors, overly broad triggers increase the chance of unintended invocation, unexpected context creation, or execution in the wrong repository.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes creating a complete context document system for projects but does not provide a clear upfront warning that it may write or modify workspace files. That is dangerous because users may invoke it expecting advisory output only, while the skill’s tools and examples enable persistent changes to repository contents.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises exec/command-line capabilities without a clear upfront shell-execution warning. In an agent environment with Bash access, this materially increases risk because users may not realize the skill can run local commands, inspect the environment, or interact with network tools, leading to unintended command execution and broader system impact.

Static analysis

No suspicious patterns detected.