加密工具基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but its published instructions could delete or expose sensitive files and credentials if followed as written.

Review before installing. Do not let an agent run the provided shred or deletion workflows unless encryption has succeeded, decryption has been tested, backups and keys are secured, and you have explicitly approved deletion. Treat the code snippets as untrusted examples: do not print API keys, password hashes, or decrypted data, and verify any password, token, TLS, or compliance code independently before using it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Unconditional Plaintext Deletion After File Encryption Attempts

Content

View full analysis

${f}.age" shred -u "$f" fi done ``` ### Technical Analysis The documented workflows invoke `shred -u` immediately after `age`, without checking the encryption command's exit status. The scripts do not use `set -e`, an `if age ...` condition, output-integrity validation, or decryption testing. Shell execution normally continues after a command returns a nonzero status. Consequently, a missing `age` executable, invalid recipient, unavailable destination, full disk, permission failure, interrupted operation, or other encryption error does not prevent deletion of the source. The comments characterize deletion as safe, but secure erasure does not establish that a recoverable encrypted copy exists. On copy-on-write, journaled, virtualized, or SSD storage, `shred` also cannot reliably guarantee physical erasure. ### Attack Path 1. A user asks the Agent to encrypt a sensitive file using the documented workflow. 2. The encryption attempt fails because of an invalid key, permission failure, exhausted storage, missing dependency, or deliberately induced environmental fault. 3. The shell continues to the next statement because no success condition guards it. 4. `shred -u` overwrites or unlinks the original plaintext. 5. The user is left without either the original file or a valid encrypted copy. An attacker able to influence the destination filesystem, recipient value, available disk space, or encryp ...[truncated 564 chars]

Remediation

View remediation

&2 rm -f -- "${f}.age" continue fi ``` - Do not delete the source automatically. Require explicit, informed user confirmation in a separate step. - Verify that the encrypted file can be decrypted with the intended identity before removing the original. - Preserve a protected backup until recovery has been tested. - Use `set -eu` where appropriate, quote all paths, and pass `--` before filename operands. - Explain that `shred` may be ineffective on SSDs, copy-on-write filesystems, snapshots, and network storage. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:209

Finding

Exposure of API Keys, Password Hashes, and Decrypted Sensitive Data in Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:76

Finding

Broken Password Verification and TLS Inspection Examples

Content

View full analysis

bool: """Verify a PBKDF2 password""" parts = stored.split('$') iterations = int(parts[1]) salt = bytes.fromhex(parts[2]) stored_hash = parts[3] computed = hashlib.encode('utf-8'), salt, iterations) return hmac.compare_digest(computed.hex(), stored_hash) ``` The bcrypt verifier omits the required stored hash argument: ```python @staticmethod def verify_password(password: str, hashed: str) -> bool: """Verify a password using constant-time comparison""" try: return bcrypt.checkpw(password.encode('utf-8')) except Exception: return False ``` The TLS version loop contains a truncated command: ```bash for version in tls1 tls1_1 tls1_2 tls1_3; do echo -n "$version: " com:443 -$version 2>/dev/null | \ grep -q "Cipher" && echo "Supported" || echo "Not supported" done ``` The FAQ includes another truncated TLS inspection command: ```bash nmap --script ssl-enum-ciphers -p 443 example.com com:443 2>/dev/null | \ grep -E "Protocol|Cipher|Verify" ``` ### Technical Analysis `hashlib.encode` is not a PBKDF2 function and the expression is malformed, so verification cannot calculate a valid comparison value. The correct operation is `hashlib.pbkdf2_hmac` with the same digest and iteration count used during hashing. Python bcrypt's `checkpw` requires both the candidate password bytes and stored bcrypt hash bytes. Omitting the second argument raises an exception. Because the example catches every exception and returns `False`, the implementation silently converts its programming error into universal authenti ...[truncated 1665 chars]

Remediation

View remediation

/dev/null ``` - Treat command failure separately from “protocol not supported.” - Add executable tests for every Python, JavaScript, and shell example before publishing the Skill. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:308

Finding

Predictable Token Generation Shown in Cryptographic Randomness Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow encrypts files and then immediately shreds the originals, but the documentation does not require validation of the encrypted output, key backup, or user confirmation. In an agent context this is dangerous because a failed encryption, wrong recipient, or missing key backup can permanently destroy sensitive data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

age-keygen -o $HOME/.config/age/key.txt
RECIPIENT=$(grep -oP 'age1\w+' $HOME/.config/age/key.txt)
echo "公钥: $RECIPIENT"
for f in .env.production database.yml secrets.json; do
    if [ -f "$f" ]; then
        age -r "$RECIPIENT" -o "${f}.age" "$f"
        echo "已加密: $f -> ${f}.age"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

age-keygen -o $HOME/.config/age/key.txt
RECIPIENT=$(grep -oP 'age1\w+' $HOME/.config/age/key.txt)
echo "公钥: $RECIPIENT"
for f in .env.production database.yml secrets.json; do
    if [ -f "$f" ]; then
        age -r "$RECIPIENT" -o "${f}.age" "$f"
        echo "已加密: $f -> ${f}.age"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md

age-keygen -o $HOME/.config/age/key.txt
RECIPIENT=$(grep -oP 'age1\w+' $HOME/.config/age/key.txt)
echo "公钥: $RECIPIENT"
for f in .env.production database.yml secrets.json; do
    if [ -f "$f" ]; then
        age -r "$RECIPIENT" -o "${f}.age" "$f"
        echo "已加密: $f -> ${f}.age"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage scenario directs encryption of sensitive files followed by deletion of the originals without a clear safety checkpoint. Because the skill targets high-value files like .env and secrets data, any mistake in recipient extraction, key handling, or command execution can lead to irreversible credential loss and service disruption.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill contradicts itself by advertising compliance checks as a core feature while later stating the free version does not support compliance checks. Contradictory security documentation is dangerous because users and agents may rely on protections that are absent, producing a false sense of assurance during sensitive operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims applicability to independent developers, enterprise teams, and automated workflows without defining boundaries. Ambiguous activation scope is risky because broad deployment contexts amplify the chance of misuse, especially when the skill has exec capability and includes file-modifying commands.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented primarily as a local encryption and compliance utility, but it also embeds active TLS probing commands against remote hosts. That expands the operational scope from local defensive assistance into network reconnaissance, which can cause the agent to perform outbound scanning actions users may not expect or be authorized to run.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

依赖详情

bash

brew install age
sudo apt install age  # Debian/Ubuntu
gpg --version

Step 2:触发加密操作

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

bash

export ENCRYPTION_KEY="your-key-here"
age-keygen -o $HOME/.config/age/key.txt
chmod 600 $HOME/.config/age/key.txt

Q3:免费版与专业版有何区别?

| 能力维度 | 免费版 | 专业版 |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The later sections claim broad automation, file handling, command execution, and API integration capabilities beyond the stated encryption-focused purpose. This mismatch can cause overbroad invocation and unsafe delegation, increasing the chance the agent performs unrelated high-risk actions under the guise of an encryption tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Claiming external API integration without clear necessity for an encryption helper broadens trust and implied authority unnecessarily. In an agent setting, that can justify unintended data egress or remote interactions not aligned with the user's expectation of a local cryptography utility.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill claims applicability to independent developers, enterprise teams, and automated workflows without defining boundaries. Ambiguous activation scope is risky because broad deployment contexts amplify the chance of misuse, especially when the skill has exec capability and includes file-modifying commands.

Content

No source excerpt is available for this finding.