Security audit

加密工具基础版

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a legitimate encryption helper, but it includes risky examples that can permanently delete files, expose secrets in logs, and run broad security/network commands without strong safeguards.

Review this skill before installing. Use it only on files and domains you control, require explicit confirmation before any command modifies or deletes files, make backups and verify decryption before removing originals, and avoid letting the agent print real keys, tokens, passwords, hashes, or decrypted sensitive data into chat or logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented scope expands from a local encryption/hash helper into generic file processing, API integration, and broad command execution features. This matters because users may invoke the skill for actions far outside the declared purpose, increasing the chance of unintended data access, file modification, or network activity under an overly trusted security-themed label.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Including TLS certificate and protocol probing extends the skill into active network security assessment, which is broader than a personal encryption helper. In an agent with exec access, this can be repurposed to scan external hosts and normalize network reconnaissance under a benign-looking skill name.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill promises not to expose sensitive outputs, yet its examples print password hashes, API keys, and decrypted sensitive data to stdout. In agent environments, stdout is often logged, retained, or shared, so these examples normalize leakage of secrets and sensitive plaintext into transcripts and logs.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger language is so broad that it overlaps with generic security testing, compliance auditing, quality inspection, and encryption tasks. Because the skill also has exec access, this broad activation surface can cause the agent to select it for higher-risk operations that exceed the narrow, expected role of an encryption helper.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The example loop encrypts files and then irreversibly deletes the originals with shred -u, without a prominent warning or verification step. In an agent-driven workflow, users may copy-paste or trigger this behavior without understanding that failed backups, wrong recipients, or decryption issues can lead to permanent data loss.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The usage scenario encrypts sensitive configuration files and deletes the originals without explicit confirmation or recovery guidance. Because these files often contain production secrets, a mistake in key generation, recipient extraction, or file handling could lock users out of critical systems or destroy the only readable copy.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The quick-start prompt encourages the agent to generate keys and encrypt files without warning that it will create sensitive key material and alter user files. In agent contexts, such prompts can lead to accidental key disclosure, unsafe key storage, or unintended modification of important environment files.

Static analysis

No suspicious patterns detected.