Security audit

聊天

Security checks for vulnerabilities and agentic risk

Overview

This skill presents itself as a Doubao chat/API helper but requests broad local read, write, and command execution authority without clear implementation or scope limits.

Review this before installing. It does not show clear malicious behavior, but it asks for local file and command privileges that are not well justified for a chat/API helper. Only use it in a constrained environment if you can confirm what commands it may run, what files it may read or write, and what data will be sent to external APIs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill is presented primarily as a chat/API integration, but later advertises file handling and system command execution as core functions without a clear need or scope boundary. This capability mismatch can cause an agent or user to grant broader privileges than necessary, increasing the chance of unintended file modification or command execution under the guise of a simple chat tool.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Declaring command execution for a chat-oriented skill violates least privilege and creates a dangerous expansion of authority without functional justification. If an agent enables this skill based on its chat description, an attacker could abuse the unexpected exec surface to run system commands or pivot into local environment access.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation guidance is overly broad, framing the skill as suitable for generic productivity, automation, workflow optimization, and efficiency gains. Such vague triggering criteria make accidental or excessive invocation more likely, which is especially risky for a skill that also declares read/write/exec capabilities.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation mentions file writing, command execution, and external API usage as major functions but does not give prominent user-facing warnings about system changes, data exposure, or execution risk in the main usage flow. This can mislead users and agent planners into treating the skill as low-risk when it can modify local state and interact externally.

Static analysis

No suspicious patterns detected.