Security audit

代码

Security checks for vulnerabilities and agentic risk

Overview

This code-explanation skill is mostly transparent, but it asks for write and command-execution authority that is broader than needed for explaining code.

Review this skill carefully before installing. It is not just a read-only code explainer as written; it may lead an agent to write files, execute commands, call external services, or process large codebases. Use it only in a constrained workspace and prefer read-only operation unless you explicitly intend those broader actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is presented as a code-explanation tool, but its documentation expands scope into code generation, code review/scoring, vulnerability analysis, CI/CD integration, and batch repository processing. This scope inflation can cause an agent or user to authorize far broader operations than expected, increasing the chance of unsafe execution, overcollection of data, or unintended modification of repositories and workflows.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Declaring exec capability for a code-explanation skill violates least privilege and creates an unnecessary path to system command execution. Even if the markdown does not include a concrete exploit, an agent may infer that command execution is authorized for normal use, enabling harmful filesystem, process, or network actions unrelated to explanation.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Advertising code generation in a skill framed as an explanation tool broadens the trust boundary and may induce an agent to create or modify code when the user expected read-only analysis. That increases risk of introducing insecure code, unintended changes, or prompt-routing into a more privileged behavior set.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill advertises file writing, external API integration, and system command execution despite being positioned as a code-explanation tool. Those side-effecting capabilities materially increase risk because they enable data exfiltration, local modification, and arbitrary command execution under a misleadingly low-risk description.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Broad activation wording such as applying the skill to generic development assistance, debugging, testing, and deployment can cause over-invocation outside its intended scope. In the presence of exec/write/API-capable tools, ambiguous routing becomes dangerous because the skill may be selected for sensitive workflows where users did not intend to grant side-effecting authority.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown advertises file writing, API calls, and command execution without prominent user-facing warnings about system and data impact. This is dangerous because users may invoke what appears to be a low-risk explanatory skill without realizing it can modify files, call external services, or execute commands, leading to unintended data exposure or system changes.

Static analysis

No suspicious patterns detected.