文本语义压缩器(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.1

Overview

The skill is a text-compression helper, but it requests command-execution access that its own documentation says is unnecessary.

Review this before installing. It appears to be a normal text-compression skill, but install it only if your agent platform can deny or separately approve `exec`; also avoid using it on sensitive medical, legal, financial, credential, or security-critical text unless you control where any saved outputs and backups go.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:22

Finding

Unnecessary Command-Execution Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-25
Vulnerability Type: Excessive tool permission
Risk Level: Low

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

The inconsistency is confirmed by the skill's runtime description at lines 297-298:

markdown

### Availability Classification
- **Classification**: MD (pure Markdown instruction-driven, no exec command-line capability required)
- **Description**: Markdown-based AI skill that uses natural-language instructions to direct the agent to perform compression and validation

Technical Analysis

The skill declares access to the exec tool even though its documented functionality consists solely of semantic text compression, anchor extraction, reconstruction, validation, and optional file input or output. The skill explicitly states that command-line execution is unnecessary.

Requesting exec exceeds the minimum permissions required for the stated task. If the hosting agent grants tools according to this metadata, loading or activating the skill may expose a general command-execution channel that is unrelated to text compression.

The reviewed skill contains no instruction that actively invokes exec; therefore, this is an excessive-permission weakness rather than evidence of current malicious command execution. Exploitation would require an additional malicious or attacker-controlled instruction source, such as prompt injection in processed content or a later compromise of the skill instructions.

Attack Path

1. A user installs or activates the skill.
2. The agent platform reads the declared tools metadata and grants the skill access to exec.
3. The skill processes attacker-controlled text or encounters another compromised instruction source.
4. The malicious content attempts to redirect the agent into invoking exec.
5. If the platform does not independently enforce strict tool authorization and command sandboxing, commands execute with the ...[truncated 592 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool list:

yaml

tools:
  - read
  - write

2. If users provide text directly and no files must be stored, consider removing read and write as well.
3. Enforce tool permissions at runtime rather than trusting skill metadata alone.
4. Require explicit user approval before granting command execution to any skill.
5. If command execution is introduced in a future version, document the exact commands and use cases, restrict executable paths and arguments with an allowlist, run commands in a sandbox with minimal operating-system privileges, and prevent access to secrets and unrelated files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description uses broad language such as improving work efficiency and being suitable for development scenarios, which weakens trigger boundaries and may cause the skill to activate in unrelated contexts. In an agent ecosystem, vague matching criteria are risky because they can expose the skill's unnecessary permissions, including write and exec, more often than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a semantic text compressor, but it declares read, write, and exec capabilities plus broad create/query/export/import/reset style operations unrelated to the core function. Overbroad permissions and generic operational language expand the skill's effective authority beyond user expectations, enabling file modification or command execution in contexts where only text transformation should be needed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Command execution capability is not justified by the described Markdown-based semantic compression workflow. Even without explicit malicious instructions, granting exec to an otherwise text-only skill increases attack surface and could let downstream agent behavior invoke local commands under the guise of compression-related processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill mentions exporting, saving, and local file storage, but it does not clearly warn users that invoking it may write files or persist sensitive text locally. For a tool intended to handle long prompts, conversation history, or knowledge-base content, silent write behavior can create confidentiality and data handling risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The capability coverage section enumerates generic keywords rather than strict invocation criteria, making the skill easier to overmatch during automatic skill selection. Because the skill also declares file and exec-related tooling, ambiguous triggers materially raise the chance of unnecessary privileged activation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation explicitly classifies itself as pure Markdown instruction-driven and says it does not need exec, yet the manifest grants exec capability. This mismatch creates unnecessary privilege and can cause an agent platform to expose command execution for a task that should only require text processing, increasing the risk of unintended shell use or abuse if the skill is triggered inappropriately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The sample configuration sets 'language: zh' as the target language, which establishes a specific locale/language preference in natural-language content. There is no accompanying statement that this is optional or user-selected, so it can be read as a default language constraint without opt-in.

Content

No source excerpt is available for this finding.