加密博弈论分析（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This skill is mainly a crypto game-theory analysis guide, but it requests shell-command access that its own instructions do not justify.

Review before installing. The analysis content itself is coherent, but the skill should not need shell-command access for this task. Install only if your agent can deny exec or you trust the publisher and run it with a restricted sandbox; otherwise ask the publisher to remove exec and narrow the input contract.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Unnecessary Shell Execution Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Excessive tool permission
Risk Level: Medium

yaml

tools:
  - read
  - exec
  - glob
  - grep

Technical Analysis

The skill declares access to the exec tool, which permits shell-command execution under the privileges of the hosting agent process. The documented functionality consists of qualitative game-theory analysis performed from user-provided information and does not describe any operation requiring local command execution.

Granting exec therefore violates the principle of least privilege. Although the skill contains no explicit malicious command, unnecessarily exposing a command-execution channel increases the consequences of prompt injection or unsafe interpretation of untrusted protocol documentation. Read-only tools are sufficient for the stated analysis workflow.

Attack Path

1. An agent loads the skill and grants all tools declared in its front matter, including exec.
2. The user supplies untrusted protocol content or instructions for analysis.
3. Malicious content attempts to persuade the agent to treat embedded shell commands as required analysis steps.
4. Because the skill has shell-execution permission, the agent may invoke exec rather than remaining within a read-only analysis boundary.
5. Any resulting command runs with the filesystem, process, and network permissions available to the agent host.

This attack path is conditional on the host agent following adversarial content; the reviewed file does not itself issue a command.

Impact Assessment

Successful exploitation could allow command execution within the security context of the agent process. Depending on host sandboxing, this may expose readable files, environment variables, project data, available credentials, local processes, or network-accessible resources. The scope is limited by the operating-system permissions, sand ...[truncated 67 chars]

Remediation

View remediation

Remediation Suggestions

Remove exec from the declared tool list and retain only the read-only capabilities required by the documented workflow:

yaml

tools:
  - read
  - glob
  - grep

Additionally:

1. Configure the host platform to deny undeclared tool use.
2. Treat analyzed protocol documents and user input strictly as data, not executable instructions.
3. If command execution becomes necessary in a future version, expose narrowly scoped operations instead of a general shell.
4. Run any unavoidable command in a sandbox with restricted filesystem access, no inherited secrets, minimal network access, command allowlisting, and explicit user confirmation.
5. Add a permission-review check to release validation so that each declared tool is tied to a documented functional requirement.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is framed in very broad terms for 'game theory related development scenarios' and repeats generic claims about applicability without clear invocation boundaries. In an agent ecosystem, this can cause over-triggering or selection for loosely related tasks, leading the agent to apply the skill outside its intended domain and potentially invoke unnecessary capabilities such as exec.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The input contract accepts generic 'input data or instructions' without narrowing the accepted content to protocol descriptions, mechanism parameters, or analysis questions. This ambiguity makes it easier for an agent to route arbitrary user requests into the skill, expanding its operational scope and increasing the chance of misuse or unintended execution paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.