Security audit

CSS工具箱(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a CSS reference skill, but it asks for shell and file-editing authority while also giving conflicting claims about being offline and documentation-only.

Review this before installing. It does not show destructive code or exfiltration, but the requested Bash and file-editing tools are broader than needed for a CSS reference manual, and the documentation is internally inconsistent about commands, network use, and API keys. Prefer installing only after the publisher removes unnecessary Bash/Write/Edit access or clearly scopes any active operations.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill presents itself as a pure offline Markdown reference, but nearby sections introduce runtime behaviors such as API usage, network checks, command execution, and operational workflows. This inconsistency can cause an agent or user to grant broader trust and permissions than warranted, increasing the chance that unnecessary tools or networked behavior are enabled under false assumptions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file gives contradictory API key guidance: one section says no API key is required, while another says some features require API keys. Conflicting security guidance can mislead users into exposing credentials unnecessarily or operating the skill under an incorrect trust model.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The manifest requests Bash while the body claims the skill is Markdown-only and requires no command execution capability. This mismatch is dangerous because it grants a powerful execution surface that is unjustified by the stated purpose, enabling accidental or unauthorized command execution if an agent trusts the manifest.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is described as a CSS knowledge toolkit, yet it also claims generalized operational abilities such as create/query/export, modify/reset/import, save/convert, and execution logging. This scope inflation can cause an agent to treat a passive documentation skill as an active workflow tool, creating opportunities for unintended file changes or misleading task delegation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Bash is a high-risk capability and appears unnecessary for a CSS consultation/documentation skill. Unjustified access to shell execution expands the attack surface and raises the likelihood of harmful actions from prompt confusion, future edits, or unsafe agent behavior.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The markdown advertises write/import/modify/save-style operations without clear user-facing warnings about data impact or confirmation requirements. In an agent environment, that can normalize state-changing behavior and lead to unintended file edits or imports if the skill is invoked broadly.

Static analysis

No suspicious patterns detected.