文件浏览器(免费版)

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:14 AM UTC
• Version: 1.0.3

Overview

This file-browser skill is mostly aligned with file management, but it gives an agent broad command-driven file mutation ability, including deletion and cross-filesystem moves, without clear workspace limits or required confirmations.

Install only if you are comfortable letting the agent run local file-management commands. Keep usage limited to a specific workspace, require explicit confirmation before move/delete operations, avoid sensitive directories, and do not rely on the skill's own text as a sufficient safety boundary.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation includes code for copy, move, delete, rename, mkdir, and touch, which goes beyond passive browsing/search and introduces destructive filesystem capabilities. In an agent skill context, examples often become implementation guidance or are copied directly, so undocumented state-changing behavior increases the risk of accidental data loss or misuse.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation description is excessively broad, covering generic file handling, conversion, format transformation, and content extraction use cases without tight scoping. In an agent environment, this can cause over-selection of a skill that has powerful read/exec capabilities, increasing the chance it is invoked on sensitive tasks beyond its safe design assumptions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises destructive operations including rm alongside read and exec access, but does not place strong consent, confirmation, or path-safety controls next to that capability. In an autonomous or semi-autonomous agent setting, this raises the risk of unintended deletion, especially if user input or model inference selects the wrong path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command cheat sheet presents rm as a normal command without an adjacent warning, backup recommendation, or confirmation requirement. Because this skill is meant for agent-driven execution, normalizing deletion commands without safeguards can lead to accidental irreversible data loss from misinterpreted prompts or path confusion.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown examples demonstrate state-changing filesystem operations, including deletion, without warning about persistence, overwrite behavior, or data loss. In a tool/skill setting, users or downstream agents may execute examples verbatim, making unsafe examples a practical security and reliability risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 目录浏览 | 支持（ls/tree） |
| 文件查看 | 支持（cat/head/tail） |
| 基础搜索 | 支持（find/grep） |
| 文件操作 | 支持（cp/mv/rm/mkdir） |
| 文本预览 | 支持（前N行/后N行） |
| 文件信息 | 支持（ls -la/stat） |
| 批量操作 | 不支持（需专业版） |

• Confidence: 96% confidence
• Finding: This skill exposes potentially dangerous file-manipulation primitives such as rm through tool-enabled workflows, yet the markdown provides no enforceable constraints on parameters, target directories, or confirmation flow. In context, the combination of broad task routing plus exec/read permissions makes parameter abuse materially dangerous because a prompt-derived path could trigger deletion or overwrite of arbitrary accessible files.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

可能原因：(1) 搜索范围过大，建议限定目录；(2) 包含大量大文件，建议排除node_modules/.git等目录；(3) 内容搜索时文件过多，建议限定文件类型。免费版可通过 `exclude_dirs` 参数排除目录。

### Q4：支持哪些文件系统操作？
免费版支持：目录浏览（ls/tree）、文件查看（cat/head/tail）、基础搜索（find/grep）、文件操作（cp/mv/rm/mkdir/touch）、文件信息（stat）。如需压缩解压、文件监控、权限管理等高级操作，需升级专业版。

### Q5：可以跨文件系统操作吗？
可以。免费版支持跨文件系统复制和移动（如从本地到网络驱动器）。但跨文件系统操作可能较慢，且某些元信息（如权限）可能无法保留。

• Confidence: 95% confidence
• Finding: Later sections again normalize destructive and mutating operations like rm/mkdir/touch, including cross-filesystem copy/move, without specifying authorization boundaries or path restrictions. In an agent skill with exec capability, this broadens the blast radius from a mistaken or manipulated argument to potentially large-scale modification or deletion across reachable storage.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.