决策架构师免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 1.0.2

Overview

The skill appears to be a decision-analysis prompt, but it asks for command execution and file-write authority that its own documentation says it does not need.

Review this skill before installing because it requests more local authority than its documented decision-analysis function needs. It should be safer if limited to prompt-only operation, or at most explicit user-selected reads; exec and write should not be granted unless the publisher documents exactly why they are needed and how they are constrained.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Excessive Command Execution and Filesystem Write Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-17
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill requests arbitrary command execution and filesystem write capabilities even though its documented purpose is limited to Markdown-driven decision analysis. The same file states that the skill does not require command execution, performs no network requests, and does not provide persistent storage.

Granting exec and write therefore exceeds the minimum permissions required for the stated functionality. If the hosting agent automatically grants tools declared in skill metadata, malicious or untrusted content processed during a decision analysis could attempt to induce the agent to invoke these unnecessary capabilities.

The declaration alone does not demonstrate that commands are automatically executed, and no malicious command payload was found. The risk arises from unnecessary exposure of powerful host capabilities and depends on the enforcement and confirmation model of the Agent platform.

Attack Path

1. A user or external source supplies adversarial text as decision-analysis input.
2. The skill is loaded with its declared exec and write capabilities.
3. The adversarial text attempts to influence the Agent into treating embedded instructions as part of the workflow.
4. If the platform does not independently enforce tool authorization or require user confirmation, the Agent invokes exec or write.
5. Commands may run with the Agent process's operating-system privileges, or files accessible to that process may be created or modified.

Impact Assessment

Successful exploitation could permit command execution and filesystem modification within the privileges of the Agent host process. The practical scope may include alteration o ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary command execution and write permissions:

   yaml

   tools: []
   

2. If analysis of user-selected local documents is an intended feature, retain only read and restrict it to explicitly selected files or the project workspace.
3. Do not grant exec or write unless a documented feature requires them and their allowed commands, arguments, paths, and outputs are strictly constrained.
4. Require explicit user confirmation before any future shell execution or filesystem modification.
5. Enforce workspace path allowlists, reject path traversal, and prevent access to credentials, configuration directories, and other sensitive locations.
6. Align the metadata with the documented Markdown-only behavior so that the declared permissions accurately reflect runtime requirements.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown/manifest content says the skill is suitable for '需要decision architect相关能力的开发场景' and '相关开发场景' without defining concrete trigger phrases, boundaries, or exclusion conditions. That scope is broad and ambiguous enough to overlap with many ordinary requests about planning or decision-making, which could cause unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that the free version does not persist memory or save decision records, but the manifest includes write capability without any documented operational need. Unnecessary write access can allow unauthorized file creation or modification, including logging sensitive user decisions or altering local workspace files contrary to user expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documentation explicitly claims it is pure Markdown and does not require exec capability, yet the manifest grants exec access. This mismatch increases risk because agents or platforms may authorize command execution unnecessarily, expanding the skill's attack surface and enabling future prompt/instruction changes to invoke shell commands under misleading documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file presents the display name, description, instructions, examples, and operational guidance almost entirely in Chinese, but does not state that the skill is Chinese-only or provide an opt-in language/locale choice. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.