Security audit

文件浏览器(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is a local file browser skill, but it gives an agent broad command-driven file modification abilities without clear scoping or confirmation safeguards.

Review before installing. Use it only in directories you intentionally allow the agent to manage, and require explicit confirmation before delete, move, overwrite, or recursive directory operations. Do not rely on the advertised conversion, API, batch, or network-related claims unless the publisher adds clear implementation and data-flow documentation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest and top-level description present the skill as a simple local file browser, but the body broadens scope to document conversion, content extraction, and API-style capabilities that are not actually implemented or bounded. This mismatch can cause an agent to invoke the skill for tasks outside its real safety model, increasing the chance of unintended file access or unsafe command execution under false assumptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation language is overly broad, covering generic file handling, document conversion, format conversion, and content extraction. Over-broad routing criteria can cause the agent to select this skill for unrelated tasks, where its exec and file-operation capabilities may expose or modify local data beyond user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description states '支持中文交互', and the document is written as if Chinese is the expected interaction mode, but it does not mention that users may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises destructive commands like cp, mv, rm, and directory creation as standard functionality without strong warnings, guardrails, or explicit confirmation requirements. In an agent setting with exec access, this materially raises the risk of accidental or prompt-induced file deletion, overwrite, or workspace corruption.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The error-handling guidance tells operators to test network connectivity and inspect firewall/proxy settings even though the skill is described as a local file browser. This can mislead an agent or user into expanding troubleshooting into unrelated network actions, widening operational scope beyond the intended local-only behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation says the free edition does not support batch operations, but examples and efficiency claims discuss processing many files and repeated execution. These inconsistencies can cause agents to over-trust unsupported automation paths, potentially resulting in accidental mass file operations if the surrounding platform interprets the instructions broadly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: One section says the skill is purely local and requires no cloud or network use, while another discusses HTTPS network communication and external API integration. Contradictory trust boundaries are dangerous because users and agents cannot reliably determine whether data may leave the host or whether network-facing behavior should be restricted.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the skill should be used for '文档转换、格式互转、内容提取', which implies conversion or extraction capabilities. The provided code examples implement directory listing, tree display, file metadata lookup, filename/content search, and file copy/move/delete/rename/create operations, but no document conversion or content-extraction logic appears anywhere in the file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented skill includes destructive primitives like delete, move, rename, copytree, and mkdir/touch without any path restrictions, sandboxing, or safety checks. In an agent skill context, these capabilities can be driven by untrusted prompts or mistaken instructions, leading to arbitrary local file destruction or tampering well beyond a simple browsing/search tool's stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown presents destructive file operations as normal examples without warning, confirmation guidance, or operator safeguards. In a tool intended for agent use, this increases the likelihood of accidental or prompt-induced deletion/modification because users may assume the capability is safe and aligned with the non-destructive browsing/search description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The top-level description suggests broader transformation workflows such as document and format conversion, while the limitations section says important adjacent capabilities like compression/decompression are not supported and the rest of the file contains no corresponding conversion implementation. This creates conflicting intent signals about whether the skill is a browser or a converter.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The configuration example reads multiple environment variables to alter runtime behavior. For a simple local file browser this is not inherently malicious, but it is an extra capability not clearly stated in the manifest's purpose and can broaden access to host configuration data beyond straightforward file operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file is entirely presented in Chinese, including headings and explanatory text, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. A forced language/locale without user opt-in can violate natural-language policy requirements.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The demonstration code accesses f['size_human'], but list_directory's long_format branch only populates name, type, size, modified, and permissions. This directly contradicts the apparent documented example usage and would fail at runtime, making the example misleading about the method's actual output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.