日报生成器基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 1.0.3

Overview

This daily-report skill mostly matches its stated purpose, but it asks agents to inspect credential-related environment variables and gives inconsistent privacy and network-use statements.

Review this skill before installing. It appears to be a Markdown-only daily report helper, not malware, but you should remove or ignore the environment-variable checking commands, avoid running it where secrets are present, and require explicit approval before any network/API use or file write.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:151

Finding

Unnecessary Credential-Related Environment Variable Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151–158
Vulnerability Type: Credential-related environment reconnaissance beyond the task's legitimate requirements
Risk Level: Medium

Vulnerable Code

bash

env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"
# PowerShell alternative:
Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The Skill directs the Agent to enumerate environment variables associated with API keys, tokens, and secrets as part of configuration validation. This operation is unrelated to the Skill's stated core purpose of generating a local Markdown daily report.

The Unix command masks variable values but still discloses credential-related variable names, which can reveal available services and authentication mechanisms. The PowerShell command is more dangerous because formatting matching environment-variable objects can display both names and values. Those values may consequently enter terminal output, Agent context, conversation transcripts, telemetry, or logs.

The behavior violates least privilege by requesting access to sensitive process-environment information without specifying a credential that the reporting task actually requires. No evidence shows that the Skill transmits the discovered information or uses it to obtain additional privileges; therefore, the confirmed issue is unauthorized sensitive-resource inspection rather than confirmed credential exfiltration.

Attack Path

1. A user loads the Skill to generate a local daily report.
2. The Agent follows the environment-validation instructions in SKILL.md.
3. The Agent executes one of the supplied environment-enumeration commands.
4. The command discovers environment variables with names associated with credentials.
5. On Unix-like systems, credential names become visible even though their values are masked.
6. On PowerShell, matching credenti ...[truncated 1187 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both broad environment-variable enumeration commands from the Skill.

2. Do not request API credentials for local Markdown report generation unless a concrete feature demonstrably requires them.

3. If configuration validation becomes necessary, check only an explicitly documented variable and return only whether it is present:

   bash

   if [ -n "${SPECIFIC_REQUIRED_VARIABLE+x}" ]; then
     printf '%s\n' "Configured"
   else
     printf '%s\n' "Not configured"
   fi
   

4. Never print, format, log, or return the value of a secret-bearing environment variable.

5. Remove the exec capability if report generation can be implemented through constrained read and write operations alone.

6. Apply output redaction at the Agent and logging layers as defense in depth.

7. Document every required secret by its exact variable name, purpose, and minimum permissions rather than scanning for generic terms such as KEY, TOKEN, or SECRET.

8. Add a security test confirming that routine report generation neither enumerates the environment nor includes secret values in generated files, command output, or logs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims that all data is stored locally and not uploaded to the cloud, yet elsewhere states that some functions require network access to external APIs. This contradiction can cause users to provide sensitive work-report content under a false privacy assumption, leading to unintended disclosure of internal project details or credentials-adjacent metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest and title present the skill as a simple local daily-report generator, but the body expands its scope to generic data analysis, visualization, external API use, and command execution. This creates a capability mismatch that can mislead users and agents about what the skill may do, increasing the chance of unintended network access or broader tool use than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises writing Markdown into the reports directory but does not prominently warn that invocation modifies the filesystem. In practice, users may trigger the skill expecting text generation only, while the agent performs persistent writes, which is more dangerous given the skill also lists exec/write-style capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance is broad enough to match many generic user requests, causing the skill to activate outside its narrow daily-report purpose. In a skill with exec/write capabilities, overbroad triggering increases the risk of unintended file creation, command execution, or routing unrelated tasks through a more privileged workflow.

Content

No source excerpt is available for this finding.