Security audit

CSS工具箱(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This looks like a CSS reference skill, but it requests command execution and file-writing permissions that its own documentation says are not needed.

Review this skill before installing. Its CSS advice content is ordinary and no executable files were found, but the requested exec/write authority is unnecessary for a documentation-only handbook. Prefer installing only after the publisher removes exec/write or clearly scopes and documents any file-changing or command-running behavior.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims to be a pure Markdown, offline, non-executing reference, yet the manifest grants exec/write and the troubleshooting section instructs running ping. This mismatch can cause an agent or user to trust the skill as read-only when it actually enables command execution, expanding the attack surface through capability confusion.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest presents the skill as a CSS reference handbook, but it declares exec and write capabilities that are unnecessary for a read-only knowledge skill. Overprivileged tool access increases the chance that unrelated prompts trigger file modification or command execution under the guise of normal documentation use.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Shell execution is unjustified for a CSS documentation skill and materially increases risk because any prompt-routing mistake or future content injection could leverage that capability. In this context, exec is not needed to answer CSS questions, so its presence creates avoidable command-execution exposure.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The description uses broad activation language such as code generation, debugging, testing, and deployment, which can cause the skill to be invoked for many generic engineering tasks beyond CSS reference help. Because the skill is overprivileged, overly broad routing increases the chance of accidental access to exec/write in contexts where they are unnecessary.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The capability scope enumerates broad generic keywords and workflow language without meaningful constraints, which may cause opportunistic matching on unrelated requests. In a skill that already declares exec/write, ambiguous activation broadens exposure and makes unintended tool use more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The markdown advertises create/modify/import/export/save operations but does not clearly warn that these may affect files or other resources. This can mislead users and orchestrators about side effects, especially when paired with write capability, resulting in unauthorized or surprising data changes.

Static analysis

No suspicious patterns detected.