Security audit

文档推理分析师(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a document-analysis assistant, but it asks for command and write authority and describes external writeback and workflow automation without clear user controls.

Install only if you are comfortable with a document-analysis skill that may be granted command execution and file-writing authority. Before using it on legal, business, or confidential documents, restrict or remove exec/write access where possible and require explicit approval before any DMS writeback, workflow routing, callback notification, cached result reuse, or network diagnostic command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 77% confidence
Finding: The skill is presented as a document-analysis assistant and explicitly says it will not replace professional decision-making, but elsewhere it introduces operational behaviors and tooling unrelated to that scope. This mismatch increases the chance that an agent will invoke broader capabilities than the user expects, weakening least-privilege and creating a misleading trust boundary.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Declaring `exec` for a document reasoning skill grants system command execution without a clear functional need tied to the advertised purpose. If the agent or downstream workflow uses this capability on user-influenced input, it can enable arbitrary command execution, environment probing, or abuse of the host context.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The skill markets itself as a document-analysis tool but later claims file writing, command execution, and broad automation features. This expands the capability surface well beyond user expectations and can facilitate unintended data modification, exfiltration paths, or execution of unsafe actions under the guise of analysis.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The error-handling section instructs the agent to run `ping` and troubleshoot firewall/proxy connectivity, which is unrelated to document analysis and introduces active network probing behavior. Even a simple diagnostic command can reveal network topology, create policy violations, or normalize command execution in a context where users do not expect it.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation rules are broad enough to match many ordinary document requests, increasing the chance of automatic invocation when the user did not intend to activate this specific skill. In a skill that also declares powerful tools, overbroad triggering raises the likelihood of unnecessary access to files, writes, or command execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The integration examples describe writing analysis results back to external systems and auto-routing documents, but the skill does not give a clear up-front warning that using it may trigger downstream persistence or workflow actions. This can cause unauthorized disclosure of sensitive document contents or metadata to connected systems without informed user consent.

Static analysis

No suspicious patterns detected.