T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:369- Finding
Blanket Administrator Execution Guidance Violates Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
定时调度专家
Security checks for vulnerabilities and agentic risk
Overview
This is a local scheduling skill, but its broad activation language, credential/API inconsistencies, and administrator-permission advice make it risky enough for review before installation.
Install only if you explicitly want an agent to create and manage local scheduled jobs. Review each scheduled task before enabling it, avoid embedding secrets in task text or logs, and do not run scheduler operations as administrator unless a specific command and path have been reviewed separately.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The API key section states no external API key is required, but the later FAQ says some functions require API keys via environment variables. This inconsistency can mislead users into granting credentials to a skill they believed was purely local, or into using it without appropriate secret-handling review, increasing the risk of credential exposure through scheduled automation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance is overly broad, covering generic AI/LLM/agent development contexts instead of narrowly scoping scheduler use cases. Overbroad trigger language increases the chance the skill is invoked in unrelated contexts, where its exec/write-oriented workflow could schedule unintended automated actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill fails to clearly warn users that scheduled tasks may later run automatically and could perform file writes, shell execution, or network actions. In the context of a scheduler with read/write/exec tools, omission of this warning is dangerous because persistence plus delayed execution reduces user visibility and can amplify the impact of a mistaken or malicious task definition.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation makes contradictory trust and capability claims: it says the skill is local-only and cloud-free, yet elsewhere references LLM/API usage and network/API failure modes. Users may make unsafe deployment decisions based on a false assumption that no external calls or credentials are involved, which is especially risky for a scheduler that can execute tasks automatically later.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The keyword coverage section defines an excessively vague and expansive trigger scope without guardrails. Because this skill supports persistence and delayed execution, loose activation can convert ordinary conversation into automated tasks without sufficiently explicit user intent or risk disclosure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Sections describing unrelated file parsing, API aggregation, and generic command execution materially expand the apparent scope of the skill beyond cron scheduling. In a skill with read/write/exec tools, this ambiguity can cause overbroad activation and user trust in capabilities that may perform more privileged or networked actions than expected.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The display name, summary, and description are written in Chinese and the document provides no indication that another language can be selected. This can amount to a locale/language policy issue when a skill effectively assumes a fixed language without opt-in or alternative.
- Content