Security audit

匿名聊天(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This chat skill appears non-destructive, but its instructions are too broad and mismatched for a chat tool with file and shell access.

Review this skill before installing. Use it only for chat-room management and message workflows, avoid routing database or general system tasks through it, and be careful with chat tokens, exported archives, webhook destinations, and any sensitive conversation content.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as an anonymous chat tool, but large portions of the document expand it into generic database, file, API-key, and command-execution workflows. This documentation drift can cause an agent to invoke the skill in contexts far beyond its stated purpose, increasing the chance of unnecessary file access, shell usage, secret handling, or unsafe automation under a misleading trust boundary.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The trigger guidance explicitly tells users to use this chat skill for database operations, SQL queries, and data-storage management, which directly contradicts the skill's purpose. In an agent environment, this kind of mismatch can route sensitive data or privileged workflows through the wrong tool, leading to overbroad invocation and accidental misuse of Bash, file, or network permissions.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The security and FAQ sections discuss exec capability, command failures, and command execution patterns that are not part of a normal chat-tool trust model. While this is less severe than direct unsafe code, it normalizes shell execution and may encourage agents or users to treat the skill as a general command runner, expanding risk beyond messaging use cases.

Vague Triggers

High

Confidence: 98% confidence
Finding: The trigger description is overly broad and materially mismatched: it recommends the skill for database, SQL, and storage tasks despite the skill being a chat platform. In agent orchestration, broad trigger text can cause the wrong tool to be auto-selected for sensitive workflows, which is especially dangerous here because the manifest exposes Read, Write, Edit, and Bash capabilities.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises persistent storage, message export, and webhook delivery but does not provide clear user-facing warnings about privacy, retention, third-party transmission, or sensitive-content handling. For an anonymous chat product, these features materially affect confidentiality and could cause users or agents to export, archive, or forward sensitive conversations without informed consent or policy checks.

Static analysis

No suspicious patterns detected.