Docs Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.0

Overview

This appears to be a documentation navigation skill, but it requests broad command execution and optional callback behavior without clear limits or user-control guidance.

Review this skill before installing. Use it only in a constrained workspace, avoid providing callback URLs unless you trust the destination, and do not allow it to run shell commands or modify/delete files without explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:141

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 141–146
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

bash

# Ensure Python is available
python3 --version
# ...
# Dependency
pip install requests

Technical Analysis

The environment setup directs the Agent to install requests without specifying an exact version, verifying package hashes, restricting the package index, or using an isolated environment. The demonstrated document-navigation code does not import or otherwise use this dependency, so the installation also appears unnecessary for the documented functionality.

An unpinned package reference is mutable: different executions may resolve to different releases or artifacts. If the configured package index, account, distribution artifact, dependency chain, or local package-resolution configuration is compromised, pip could retrieve attacker-controlled content. Python source distributions and build backends may execute code during package preparation or installation. A malicious package would also execute when subsequently imported.

This instruction alone does not prove that the legitimate requests package is malicious. The risk arises from unnecessary installation and the absence of supply-chain controls.

Attack Path

1. A user or Agent follows the environment-preparation instructions.
2. The Agent runs pip install requests with its current Python and package-index configuration.
3. Because no version, hash, or trusted index is specified, pip resolves mutable package artifacts.
4. An attacker who has compromised the selected artifact, an upstream dependency, package-index routing, or the environment's index configuration supplies malicious content.
5. Malicious build logic executes during source-package processing, or malicious runtime logic executes when the installed package is imported.
6. The payload operates with the permis ...[truncated 631 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install requests instruction if the Skill does not use the package.
2. If the dependency is required, declare an audited exact version rather than resolving the latest available release.
3. Require package hashes, for example through a locked requirements file installed with pip install --require-hashes.
4. Restrict installation to an explicitly trusted package index and reject unintended extra indexes.
5. Install dependencies in a dedicated virtual environment or sandbox under a non-privileged account.
6. Prefer pre-reviewed binary artifacts where appropriate, and prevent unexpected source builds.
7. Add automated dependency and vulnerability scanning, and update the lock file through a controlled review process.
8. Document why the dependency is needed and where it is used so unnecessary installation instructions do not expand the Skill's attack surface.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest exposes exec capability for a documentation-oriented skill without any prominent safety guidance, allowlist, or confirmation requirements. Because users may assume a doc-navigation tool is read-only, combining that branding with silent command execution support creates a realistic risk of arbitrary shell command use, filesystem modification, or data exposure if prompts or future instructions are interpreted unsafely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest and overview emphasize documentation navigation, sitemap/search, indexing, tracking, and basic personal-use functionality. However, the capability descriptions say the skill supports '创建/查询/导出' and later '创建/查询/修改/删除等操作模式', which expands the behavior from read/navigation into generic content-management actions not reflected in the core description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented callback_url parameter enables network transmission of task results but provides no warning about privacy, authentication, or destination trust. In practice, this can cause sensitive document content, metadata, or execution status to be sent to untrusted endpoints, especially in an agent workflow where users may not realize external callbacks occur.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Several sections characterize the free version as a streamlined, basic, single-task documentation toolkit for personal use. That intent conflicts with line L096, which states the core capability supports '创建/查询/修改/删除等操作模式', suggesting broader management semantics than the rest of the document advertises for the free edition.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill declares compatibility with essentially any agent platform and describes natural-language-driven operation without meaningful scope boundaries. In a skill that also advertises read/exec/glob/grep capabilities, this broad and underspecified invocation model can lead agents to apply the skill in unintended contexts, increasing the risk of overreach, unsafe file access, or command execution based on ambiguous prompts.

Content

No source excerpt is available for this finding.