Security audit

文本语义压缩器(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This text-compression skill is not malicious, but it asks for command execution and broad file powers that its own instructions do not justify or clearly limit.

Install only if you are comfortable with a Markdown compression skill receiving broad file access and unnecessary command-execution authority. Avoid using it on secrets, regulated records, legal/financial/medical text, or security-critical instructions unless you can constrain file writes and prevent command execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is advertised as a semantic text compressor, but the documented operations include broad create/query/export/modify/reset/import/save behaviors that are not tightly scoped to compression. This mismatch can cause an agent to grant the skill wider authority than users expect, increasing the chance of unintended file manipulation or misuse under ambiguous prompts.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The manifest exposes exec while the documentation later states the skill is pure Markdown-driven and does not require command execution. This inconsistency is dangerous because agents or operators may assume no code execution risk exists, while the granted capability enables shell-level actions if invoked.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Granting exec to a text-compression skill is unjustified by the stated purpose and materially expands the attack surface. In an agent environment, unnecessary execution privileges can be abused to run local commands, access sensitive files, or chain with read/write capabilities for broader compromise.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The description uses broad language about improving efficiency and supporting file-compressor-related development scenarios, which may trigger the skill for unrelated requests. Over-broad activation increases the risk that the agent invokes a tool-bearing skill in contexts where users did not intend text compression or associated file operations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The capability coverage section lists many broad keywords instead of precise invocation rules, encouraging overmatching. In a tool-enabled skill, ambiguous routing can result in accidental activation and unintended access to read/write or other side-effecting behaviors.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill advertises export/save behavior and local storage use but does not clearly warn users that it may write files or preserve local copies. Without explicit disclosure and guardrails, users may unknowingly permit creation, overwrite, or retention of potentially sensitive compressed text and backups.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The dependency section says processing relies on an LLM API but does not clearly warn that user text may be transmitted to platform or external model services. For a text-compression skill, users may supply large documents containing sensitive content, so omission of data-transmission disclosure creates privacy and compliance risk.

Static analysis

No suspicious patterns detected.