编解码工具箱专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.1

Overview

This encoding toolkit is mostly purpose-aligned, but it needs review because it combines broad command/file access with overbroad security-scanning triggers and inconsistent credential/dependency guidance.

Install only if you need a local encoding/decoding and format-conversion helper, and keep its use limited to files and directories you intentionally select. Avoid treating it as a general vulnerability scanner, install optional Python packages in an isolated environment with pinned versions, and do not store API tokens in the documented local credentials path unless you have secured it appropriately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:171

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 171-175
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

| openpyxl | Python library | Optional | `pip install openpyxl` | 3.0+ |
| msgpack | Python library | Optional | `pip install msgpack` | 1.0+ |
| cbor2 | Python library | Optional | `pip install cbor2` | 5.0+ |
| tomli_w | Python library | Optional | `pip install tomli_w` | 1.0+ |
| strictyaml | Python library | Optional | `pip install strictyaml` | 1.7+ |

Technical Analysis

The Skill directs an Agent or user to install third-party Python packages without exact version pins, integrity hashes, or a dependency lock file. The documented compatibility ranges do not constrain the actual pip install commands.

Consequently, installation resolves to whatever package version is available from the configured package index at execution time. A compromised upstream release, package-index account, mirror, or local package-index configuration could therefore introduce code that was not present during this audit. Python package installation may execute build backends or other installation-related code, while imported packages execute with the privileges of the Agent process.

No evidence indicates that the currently named packages are malicious. The vulnerability is the uncontrolled and non-reproducible dependency acquisition process.

Attack Path

1. An attacker compromises an upstream package release, maintainer account, configured package mirror, or dependency-resolution environment.
2. The attacker publishes or serves a malicious version under one of the documented package names.
3. An Agent follows the Skill documentation and runs the corresponding unpinned pip install command.
4. Package installation or a later import executes attacker-controlled code.
5. The code operates with the permissions and accessible environment o ...[truncated 551 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the installation examples with a reviewed dependency manifest containing exact versions, such as:

   text

   openpyxl==3.1.5
   msgpack==1.1.0
   cbor2==5.6.5
   tomli_w==1.2.0
   strictyaml==1.7.3
   

2. Generate and verify cryptographic hashes using a lock tool such as pip-tools, and install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Review the selected package versions and their transitive dependencies before publishing the lock file.
4. Install dependencies in an isolated virtual environment or container under a non-privileged account.
5. Use a trusted, explicitly configured package index and prevent unintended fallback to untrusted indexes.
6. Add automated dependency vulnerability and provenance scanning to the release process.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:255

Finding

Unrestricted User-Defined Regular Expressions Can Cause Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 255-257
Vulnerability Type: Regular-expression denial of service
Risk Level: Medium

Vulnerable Code

python

elif stage.startswith('regex_extract:'):
    pattern = stage.split(':', 1)[1]
    m = re.search(pattern, text)
    text = m.group(0) if m else ''

Technical Analysis

The custom pipeline extracts an arbitrary regular expression from the stage value and passes it directly to Python's standard re.search function. There is no pattern allowlist, complexity validation, input-length restriction, execution timeout, or isolation boundary.

Python's standard regular-expression engine uses backtracking for relevant pattern constructs. A maliciously constructed expression containing nested or ambiguous quantifiers can require exponential processing time when applied to a carefully chosen non-matching input. This condition is commonly known as regular-expression denial of service.

For example, a stage containing a pattern structurally similar to regex_extract:^(a+)+$, combined with a long string of a characters followed by a non-matching character, can consume substantial CPU time.

Attack Path

1. An attacker gains control of, or influences, the custom pipeline stage and input text.
2. The attacker supplies a pathological expression through a regex_extract: stage.
3. The attacker supplies a long input designed to force extensive backtracking.
4. re.search(pattern, text) evaluates the expression synchronously without a timeout.
5. The Agent worker consumes excessive CPU and becomes slow or unresponsive, potentially delaying other tasks handled by the same process.

Impact Assessment

Exploitation can cause CPU exhaustion and denial of service in the process executing the pipeline. If the Skill runs in a shared Agent worker, the impact may extend to other tasks assigned to that worker.

The vulnerable operation does no ...[truncated 171 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept arbitrary regular expressions when predefined extraction operations can satisfy the use case.
2. Define an allowlist of reviewed patterns or expose structured extraction parameters instead of raw regex syntax.
3. Enforce strict maximum lengths for both the pattern and input text before evaluation.
4. Reject nested quantifiers, backreferences, ambiguous alternations, and other constructs associated with catastrophic backtracking.
5. Prefer a linear-time regular-expression implementation, such as an RE2-compatible engine, when untrusted patterns must be supported.
6. Execute regex processing in an isolated worker with CPU, memory, and wall-clock limits. Terminate the worker when its deadline is exceeded.
7. Add regression tests using adversarial patterns and long non-matching inputs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's display name, summary, and description are presented in Chinese only, with no indication that the user may choose another language or that the locale is intentionally restricted. This can violate language/locale policy when a skill effectively enforces a single language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill for broad situations such as '安全检测、合规审计、漏洞扫描、加密防护', which spans many unrelated tasks and does not clearly define what user requests should invoke this specific skill versus other security or automation skills. It also lacks explicit trigger phrases, boundaries, or negative examples beyond unauthorized penetration testing, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API key configuration section describes the skill as being based on local command-line tools and the standard library, implying minimal external dependency. However, the file elsewhere lists optional third-party Python packages such as msgpack, cbor2, tomli_w, and strictyaml, and mentions possible external API usage and httpx-style network streaming, which conflicts with that characterization.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill gives conflicting credential-handling guidance: it says API keys are loaded from environment variables, but also instructs storing sensitive tokens in a local directory. Mixed guidance increases the chance that operators persist secrets insecurely on disk, weakening secret hygiene and potentially exposing tokens through filesystem access, backups, or misconfigured permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.