Security audit

日报生成器专业版

Security checks for vulnerabilities and agentic risk

Overview

This daily-report skill is not clearly malicious, but it asks for broad file, command, API, credential, and external callback capabilities without enough scoping or user-control detail.

Install only if you are comfortable granting this skill broad agent authority. Before use, restrict it to specific repositories, calendars, task systems, output folders, and approved webhook domains; avoid enabling Bash or callbacks unless needed, and do not provide broad API credentials without clear connector-level limits.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest markets a narrow daily-report generator, but the body expands the skill into broad automation involving file access, external integrations, and command execution. This scope mismatch can cause users or an agent runtime to grant more trust and permissions than the declared purpose warrants, increasing the chance of unsafe tool use.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Advertising command execution for a daily-report skill is dangerous because it normalizes use of Bash for a task that does not inherently require shell access. In an agent environment, this can lead to unnecessary execution of system commands, expanding attack surface to command injection, filesystem modification, or environment data exposure.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs use of API keys and external service connections without clearly constraining what services are accessed or what data may be transmitted. For a daily-report tool, this broad integration language can prompt over-privileged configuration and unintended disclosure of internal work data to third-party systems.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: An overly broad natural-language trigger can cause the skill to activate in contexts where the user did not intend to invoke it. Because this skill also advertises file, API, and command-related capabilities, accidental invocation could lead to unnecessary data processing or external/system actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The example trigger phrase is so generic that it can match ordinary conversation, making unintentional activation more likely. In an agent setting, generic triggers are risky when paired with tools that can read, write, call networks, or execute commands.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states it can automatically collect content from Git, calendars, and task systems, but it does not prominently warn users that potentially sensitive workplace data may be accessed and aggregated. This can lead to silent over-collection of internal activity data beyond user expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: A callback URL feature creates a clear exfiltration path because generated reports, metadata, or logs may be sent to arbitrary external endpoints. Without a warning or restrictions, users may unknowingly transmit sensitive work information outside trusted boundaries.

Static analysis

No suspicious patterns detected.