Security audit

博弈论分析免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a game-theory analysis guide, but it asks for broad tool authority and uses overly broad analytics triggers that could route unrelated tasks into a write-capable skill.

Review before installing. The game-theory examples themselves are not harmful, but users should treat this as an overbroad Markdown skill: limit use to explicit game-theory tasks, avoid letting it handle general analytics/reporting requests, and require explicit confirmation before any save/export/modify/reset/import action.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest and description materially overstate the skill’s scope, advertising generic analytics, report generation, visualization, and workflow operations that are not implemented in the provided logic. In an agent setting, this can cause inappropriate routing and user over-trust, leading the agent to invoke a tool for tasks it cannot safely or correctly perform.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation exposes configuration, export, save, convert, modify, reset, and import-style operations without any backing implementation or execution constraints. This is dangerous because agents may infer these actions are supported and attempt file or state-changing behavior, especially since the skill declares write capability.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger language is broad enough to capture ordinary analytics, reporting, statistical insight, and visualization requests unrelated to game theory. In agent ecosystems, overly broad activation criteria can hijack unrelated user tasks, causing misuse of exec/write-capable skills and reducing the predictability of tool selection.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The dedicated trigger section is vague and fails to provide clear positive and negative boundaries for activation. This ambiguity increases the chance that an agent will invoke the skill outside its intended domain, which is more concerning here because the manifest also advertises broader analytics behavior and includes write-capable tooling.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill advertises export/save operations without clearly disclosing that they may write to disk or alter local state. Because the skill declares write access, this can mislead users and downstream agents about side effects, undermining informed consent and safe handling of data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.