Security audit

文档凭证注册工具专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it asks an agent to perform high-impact enterprise credential, export, webhook, and dispute actions without enough scoping or confirmation guidance.

Review this skill before installing in a real enterprise workspace. Use least-privilege API keys, avoid storing real keys in plain config files, require explicit approval for bulk registration, import/reset, dispute, webhook, and export actions, and restrict export destinations because tenant credential and reputation data may be sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill’s own security guidance says API keys should not be hardcoded in configuration files, yet the example stores an API key in `$HOME/.doc-print/pro.json`. Even with `0600` permissions, local config files are commonly copied into backups, dotfile sync tools, support bundles, or accidentally committed, which increases credential exposure risk.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The skill is classified as `MD+EXEC` and describes broad natural-language-driven execution without clear trigger boundaries, confirmation requirements, or scope limits. In an agent environment with `read`, `write`, and `exec` tools, vague invocation language can cause overbroad activation and unintended actions such as registration, export, or network operations without sufficient user intent verification.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly allows export/save/convert operations but does not warn that exported credential, exchange, reputation, or audit data may contain sensitive tenant or identity information. In this context, silent export functionality is more dangerous because the skill is positioned for enterprise multi-tenant governance and auditing, where bulk data movement can create confidentiality and compliance issues.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill promotes event subscriptions and webhook delivery without an explicit warning that task, dispute, or identity-related data will be transmitted to external endpoints. In an enterprise governance tool, webhook flows can leak sensitive operational metadata or personal/business information if recipients, signing validation, retention, or transport controls are not carefully documented.

Static analysis

No suspicious patterns detected.