T08 · Insecure Dependencies
Warning
- Location
SKILL.md:323- Finding
Unpinned Installation of a Third-Party Security Tool
- Content
View full analysis
- Remediation
View remediation
Security audit
网络安全评估引擎免费版
Security checks for vulnerabilities and agentic risk
Overview
This is a project security self-check skill with disclosed command-based scanning, but its documentation is inconsistent and some shell examples are unreliable.
Install only if you are comfortable letting the skill read and scan the target project and run local audit commands when you ask it to. Avoid running it as administrator, review any generated pre-commit hook before enabling it, and use pinned tools in a virtual environment or container for dependency auditing.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:152- Finding
Failed Directory Change Allows Scanning of an Unintended Location
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` Additional hardening should include: - Resolve and validate the target path before scanning. - Confirm that the target is a directory and is within any permitted workspace boundary. - Print the resolved working directory before starting the scan. - Return a nonzero status when initialization or any mandatory scan phase fails. - Distinguish scan errors from successful scans with zero findings. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:47- Finding
POSIX Shell Declaration Is Incompatible with Bash-Style Arithmetic Commands
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:292- Finding
Unsafe Parsing of Git Filenames Permits Pre-Commit Secret-Scan Bypass
- Content
View full analysis
/dev/null) ``` ### Technical Analysis Git permits filenames containing spaces, quotes, tabs, newlines, and leading hyphens. The hook serializes staged filenames as newline-delimited text, stores them in shell command substitution, and then lets `xargs` parse that text again. This does not preserve filename boundaries. A filename containing whitespace or quoting characters may be split or rejected, while a filename beginning with `-` may be interpreted by `grep` as an option because the command does not use an option terminator. Errors are hidden by redirecting standard error to `/dev/null`. This creates a bypass in a control intended to prevent secrets from being committed. The construction does not invoke an additional shell through `xargs`, so arbitrary shell-command execution was not established from this code alone. ### Attack Path 1. An attacker or repository contributor creates a tracked file whose name contains whitespace, a newline, quote characters, or begins with a hyphen. 2. The file contains a credential matching one of the configured secret patterns. 3. The file is staged for commit. 4. `git diff --name-only` emits a textual filename representation that is not safely preserved through command substitution and `xargs`. 5. `xargs` splits, rejects, or reinterprets the filename; a leading-hyphen filename may also affect `grep` option parsing. 6. Standard-error suppression conceals the processing failure. 7. The matching file is not reliably scanned, allowing the commit to proceed with the secret. ### Impact Assessment The defect does not directly increase operating-system privileges. It can bypass the repository's secret-prevention control and ...[truncated 273 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description promises a lightweight, knowledge-driven security self-check that does not require installing extra tools. However, the documented workflow depends on Bash execution plus tools such as npm audit, pip-audit, grep, jq, and even labels LLM API as required, which materially changes the behavior from pure knowledge guidance to tool-backed scanning.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is not merely incomplete documentation: one section asserts no extra tools are needed, while later sections list grep as required, npm/pip-audit/jq as dependencies, and classify the skill as 'MD+EXEC' needing command execution capability. Those statements directly contradict the earlier claim about a pure knowledge-driven, no-extra-tool free edition.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md echo " [!] 未找到.gitignore文件" ((ISSUES++)) else for entry in '.env' 'node_modules' '*.key' '*.pem'; do grep -q "$entry" .gitignore 2>/dev/null && echo " [OK] .gitignore包含: $entry" || echo " [!] .gitignore缺失: $entry" done fi
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The display name, summary, and description are all presented solely in Chinese, and the rest of the skill instructions continue in Chinese without offering a language choice. This can violate language/locale policy where users are not explicitly given an opt-in or alternative locale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The summary and description emphasize basic assessment, OWASP auditing, and threat modeling for quick self-review. The file also documents writable threat-register management and states input supports '创建/查询/导出', which goes beyond pure assessment into artifact management and file generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes its activation and capability coverage in broad, open-ended terms without strong trigger constraints, while also declaring powerful tools such as Read, Write, Edit, and Bash. In an agent environment, vague activation boundaries can cause the skill to over-apply, perform unintended file modifications, or run commands in contexts the user did not explicitly authorize.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The document says the free version needs no extra API key, yet the dependency table marks 'LLM API' as required and troubleshooting includes API authentication, rate limiting, timeout, and network-failure cases as expected operating conditions. That creates an intent/documentation contradiction about whether external API-backed operation is required.
- Content