Security audit

加密工具专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with encryption and audit work, but it gives agents high-impact read/write/exec workflows with weak scoping and includes unsafe encryption examples users could mistake for real protection.

Review this carefully before installing. Use it only on explicitly selected paths, avoid callbacks unless the destination is trusted, keep generated .meta and report files out of logs and source control, and do not rely on the included envelope-encryption example for production without replacing it with real KMS key wrapping.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The skill claims outputs will not contain sensitive data, yet the batch encryption example writes encryption metadata including key identifiers, IVs, timestamps, file sizes, and an encrypted data key to disk. While some of this metadata is operationally necessary for decryption, documenting it as non-sensitive and emitting it broadly can mislead users and increase the chance that key-management details and sensitive project context are exposed through logs, artifacts, or source control.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The example claims to use KMS-style envelope encryption, but it never uses the master key to encrypt or wrap the data key. Instead, it base64-encodes the generated data key and returns it alongside the ciphertext, so anyone with the output can recover the plaintext. In a skill about encryption tooling, this misleading design is especially dangerous because users may copy it into real systems believing it provides key protection.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger condition 'use when security detection, compliance audit, quality check, encryption protection are needed' is broad enough to match many ordinary repository tasks, which may cause the agent to invoke powerful read/write/exec behavior unexpectedly. In a skill with filesystem modification and command execution capabilities, overbroad activation increases the risk of unintended scans, report generation, or destructive encryption actions on unrelated requests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The batch encryption section recursively finds matching files in the workspace and writes new encrypted outputs and metadata, but it does not prominently warn that this modifies many files across the project. In an agent context with write and exec tools, users may not realize a simple request can trigger broad filesystem changes, causing accidental encryption of secrets, certificates, configs, or operational files and disrupting development workflows.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill accepts a callback URL and generates audit/compliance reports without clearly warning that these outputs can contain sensitive project metadata such as file paths, findings, key usage details, and compliance posture. Sending results to external callbacks or storing detailed reports as artifacts can unintentionally leak internal information to third parties or less-trusted systems.

Static analysis

No suspicious patterns detected.