Security audit

日报生成器基础版

Security checks for vulnerabilities and agentic risk

Overview

This daily-report skill is mostly a Markdown report generator, but it asks for command execution and includes unclear network, API key, and credential-adjacent instructions that users should review before installing.

Install only if you are comfortable with a daily-report skill that can guide the agent to run commands, inspect API-related environment variables, and potentially use network/API workflows. Before using it with sensitive work notes, confirm that your agent will ask before running shell commands, reading secrets, writing files, or sending content to external services.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents the skill as a local daily-report generator, but the body broadens scope to external APIs, network access, and generic analytics/visualization. This mismatch can cause an agent or user to grant broader trust and permissions than warranted, increasing the chance of unintended data access or outbound operations.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill includes environment/credential inspection guidance and API key configuration despite claiming to generate local Markdown reports. Prompting an agent to enumerate variables matching API, KEY, TOKEN, or SECRET creates unnecessary exposure of sensitive configuration and expands the skill into secret-adjacent behavior unrelated to its stated task.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation states the agent may call tools or APIs and elsewhere recommends network diagnostics, which exceeds what a daily-report draft generator should require. This unnecessary expansion of operational scope increases the risk of data egress, unexpected command execution, and user confusion about what the skill is allowed to do.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill claims all data remains local and is never uploaded, but other sections describe external API and network-dependent operation. This contradiction is dangerous because it can mislead users into providing sensitive work content under a false privacy assurance, resulting in unanticipated disclosure to remote services.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation description is overly broad, covering general data analysis, reporting, statistics, and visualization rather than narrowly targeting daily report generation. Overbroad triggers make accidental activation more likely on unrelated tasks, causing the skill to run with file-write/exec capabilities outside its legitimate context.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger '请帮我生成今日日报' is generic and paired with documentation saying the agent will automatically choose tools and perform operations. Without stronger scope constraints, simple natural-language requests may trigger broader tool use than necessary, including exec or file actions without clear user understanding.

Static analysis

No suspicious patterns detected.