Security audit

图解

Security checks for vulnerabilities and agentic risk

Overview

This diagram skill appears non-destructive, but it asks for broad file, shell-command, API, and credential-related authority that is not clearly scoped to diagram generation.

Review this skill before installing. It does not contain executable scripts or obvious malicious instructions, but it grants broad read/write/exec authority and references API keys and external services without enough scoping. Use it only in a controlled workspace, avoid exposing unrelated files or secrets, and approve shell commands only when they are clearly diagram-rendering commands you expect.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a diagram-generation tool, but the documentation expands its scope to generic file processing, API integration, and command execution. This scope drift can cause an agent to grant or invoke capabilities far beyond user intent, increasing the risk of unnecessary file, network, or shell access.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Advertising command execution in a skill whose stated purpose is diagram generation creates an unnecessary high-risk capability. If an agent relies on this documentation, it may permit shell execution for untrusted diagram input or loosely related tasks, enabling command injection, data access, or host manipulation.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The documentation claims external API integration beyond the stated diagram-generation scope, which can encourage network access unrelated to the user’s requested task. This widens the attack surface for data exfiltration, SSRF-like behavior through agent tooling, or unintended transmission of user content to third parties.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation description is overly broad, making it easier for the skill to activate outside its legitimate purpose. Ambiguous activation criteria can lead an agent to select this skill for loosely related requests, exposing unnecessary tools such as read, write, or exec in contexts where they are not needed.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The documented use cases cover broad productivity and collaboration scenarios rather than narrowly defined diagram tasks. This can cause over-selection of the skill and inappropriate exposure of file, execution, or network-adjacent capabilities in situations unrelated to diagram generation.

Static analysis

No suspicious patterns detected.