Security audit

CSS工具箱(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This looks like a CSS documentation skill, but it requests command and file-write authority while giving inconsistent guidance about APIs, network use, and execution.

Review before installing. The CSS reference content itself appears ordinary, and no malicious script or exfiltration path was found, but the skill should remove exec/write or clearly disclose and bound any command execution, file modification, API-key use, and network behavior.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill presents itself as a pure offline Markdown/documentation skill, yet elsewhere advertises command execution, file operations, network diagnostics, API usage, and automation behavior. This mismatch can cause users or host agents to grant broader trust or permissions than warranted, increasing the chance that dangerous capabilities are invoked under false assumptions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Contradictory API key guidance creates ambiguity about whether the skill accesses external services or secrets. In practice, this can lead users to expose credentials unnecessarily or allow a supposedly offline skill to be treated as trusted while it attempts API-backed operations.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The manifest declares read/exec/write tooling for a skill that is described primarily as a CSS handbook. Overprivileged tooling on a low-risk documentation skill expands attack surface unnecessarily and could enable file modification or command execution if the agent follows embedded operational instructions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file claims exec capability is unnecessary, but other sections instruct command execution and provide troubleshooting for exec failures. This inconsistency undermines user consent and policy enforcement because a host may classify the skill as passive while it contains guidance that encourages active system operations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill exposes exec/write capabilities without clearly warning users in the main description that it may execute commands or modify files. Missing disclosure increases the risk of unsafe consent, especially because the surrounding content frames the skill as a benign knowledge handbook.

Static analysis

No suspicious patterns detected.