文件工具箱

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.1

Overview

The skill is a local file-management helper, but it asks for broad file read/write/execute authority and includes deletion/cleanup examples that need careful review before use.

Review before installing. Use only on explicitly chosen folders, run preview first, avoid delete_older_than or other deletion rules unless you have backups, and do not provide callback URLs unless the implementation clearly explains what is sent. The referenced script is absent from the inspected artifact, so verify the actual implementation before allowing it to move, rename, or delete files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:398

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:398
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

| PyYAML | Python library | Optional | `pip install pyyaml` (required for configuration file support) |

The original instruction invokes pip install pyyaml without specifying a package version, cryptographic hash, lock file, trusted package index, or isolated environment.

Technical Analysis

The installation command allows the package installer to resolve whichever PyYAML release is available from the configured Python package index at execution time. Consequently, the dependency installed by an Agent may differ from the dependency originally reviewed.

If the configured index, package distribution, account, or dependency-resolution environment is compromised, the command could install an attacker-controlled artifact. Python packages may execute code during installation or when imported by the file-management implementation. No malicious PyYAML artifact is included in this project; the issue is the absence of controls that make dependency resolution reproducible and verifiable.

Attack Path

1. A user or Agent follows the dependency setup instructions in SKILL.md.
2. The Agent runs pip install pyyaml using its current Python and package-index configuration.
3. Pip resolves an uncontrolled package version from that index.
4. A compromised package release, distribution account, index, mirror, or local package configuration supplies a malicious artifact.
5. Malicious installation or import-time code executes with the permissions of the user running pip or the Agent.
6. The payload can access resources available to that account, including files within the Agent's accessible workspace.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's privileges. The resulting scope ...[truncated 465 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyYAML to a reviewed exact version rather than allowing unconstrained resolution.
2. Store dependencies in a version-controlled requirements or lock file.
3. Require cryptographic hashes, for example through pip install --require-hashes -r requirements.txt.
4. Explicitly specify and document the trusted package index rather than relying on ambient pip configuration.
5. Install dependencies in a dedicated virtual environment with minimal permissions.
6. Add automated dependency scanning and a controlled update process.
7. Include the claimed file-toolkit.py implementation in the package so its dependency usage and behavior can be audited.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation scope is excessively broad and ambiguous, including generic phrases like file processing, conversion, and extraction without precise boundaries. In agent environments, this can cause over-triggering on unrelated tasks and unnecessary use of read/exec/write capabilities, raising the risk of unintended file access, modification, or destructive actions on sensitive paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims the free edition runs fully locally and does not upload file data, yet it also documents a callback_url parameter and network-error handling. This creates a trust and data-flow ambiguity: users may authorize the skill under a local-only assumption while the documented interface still permits outbound communication or future implementations that exfiltrate metadata/results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents cleanup behavior that includes deletion as part of the normal flow, but the surrounding guidance does not prominently warn about irreversible data loss. Because the skill has exec/write capability and targets user files, even a well-intentioned run could delete important documents if the preview is skipped or the plan is wrong.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented capability coverage expands beyond file organization into document conversion and content extraction, conflicting with the stated free-version limitations and core feature set. This overstatement can cause the agent or user to invoke the skill in broader contexts than intended, increasing the chance of unsafe tool use on sensitive documents or unexpected processing paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The sample configuration includes automatic deletion of files older than 90 days without an adjacent safety warning or retention caveats. Users often copy sample configs directly; in a file-management skill with write/exec access, this can normalize unsafe defaults and lead to silent loss of valuable files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file states '完全中文化表达，适配中文用户文件命名习惯', indicating the skill is intentionally fully Chinese-localized. The document does not offer an opt-in or alternative language choice, which can violate language/locale policy when a skill forces a specific language without user selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.