Security audit

仓库归档专业版

Security checks for vulnerabilities and agentic risk

Overview

This repository-management skill is mostly coherent, but its trigger text is mismatched and broad enough that it could run file, command, GitHub, or webhook workflows in unintended contexts.

Review before installing. Use it only for explicit repository archiving, monitoring, issue/PR analysis, and team sync tasks. Avoid letting it activate for SEO, marketing, or generic coding help, and confirm any Bash command, scheduled sync, shared storage setup, GitHub-token use, or webhook notification before execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The "使用时机" section says the skill should be used for SEO optimization, keyword analysis, ranking improvement, and search traffic optimization, which conflicts with the rest of the document describing repository archiving and GitHub monitoring. This kind of scope mismatch can cause the agent to invoke the skill in the wrong context and then perform file writes, command execution, or network actions on unrelated user tasks.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest description claims the skill should be used for code generation, programming assistance, debugging, testing, and deployment, while the body describes repo archival, clustering, synchronization, and alerts. Overbroad and inaccurate manifest triggers increase the chance that an agent selects this skill for general development tasks, exposing users to unnecessary command execution and external API interactions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger description is both broad and internally inconsistent, mixing generic development tasks with a specialized repository archiving tool. In an agent environment, ambiguous trigger text is dangerous because it can cause unintended invocation of a skill that has Read/Write/Edit/Bash capabilities and may touch repositories, files, or remote services without the user intending that workflow.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The "使用时机" section expands the trigger scope to SEO and ranking work that is unrelated to the tool's described repo-management functionality. This makes accidental activation more likely in unrelated conversations, increasing the risk of unintended command execution, file modification, or outbound webhook/API usage under a false assumption of relevance.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill demonstrates commands that write files, configure shared storage, schedule sync jobs, and send Slack webhook notifications, but it does not prominently warn users that it may modify local state or exfiltrate metadata to external endpoints. In a high-privilege agent setting, missing disclosure and confirmation boundaries around mutation and network egress can lead to unintended data changes or leakage.

Static analysis

No suspicious patterns detected.