仪表盘

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it asks for broad command and file authority while relying on an unverified local dashboard executable and giving inconsistent documentation.

Review before installing. Only use this if you know exactly which `dashboard` executable will run, trust its source, and can constrain it to local-only access with appropriate authentication. Do not grant broad file write or command execution authority unless the dashboard implementation and data access boundaries are independently verified.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:21

Finding

Overbroad Tool Permissions and Execution of an Unverified External Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–24; related execution instructions at lines 57 and 136
Vulnerability Type: Excessive tool authority and execution of an unspecified external program
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

The requested execution capability is used as follows:

bash

dashboard start 3853

The skill is also explicitly classified as execution-enabled:

text

MD+execute()

Technical Analysis

The skill requests unrestricted file-reading, file-writing, and command-execution capabilities even though its documented primary operation is starting and viewing a local dashboard. It does not define filesystem boundaries, an executable allowlist, permitted arguments, network destinations, or restrictions on data that the dashboard may access.

The invoked dashboard executable is not included in the audited project, and no package manifest, source code, checksum, installation source, or pinned version is provided. Consequently, the effective behavior depends on whichever executable named dashboard is resolved from the host's PATH. Its behavior cannot be verified from this project.

This violates least-privilege principles because an agent loading the skill may grant access that exceeds the narrowly documented dashboard-starting task. The issue does not prove that the skill itself contains a malicious payload, but it creates an unsafe privilege boundary and an execution channel whose implementation is outside the reviewed artifact.

Attack Path

1. A user or agent loads the skill and grants the declared read, write, and exec tools.
2. The skill directs the agent to execute dashboard start 3853.
3. The operating system resolves dashboard from the current environment's PATH.
4. An untrusted, compromised, or unexpectedly installed executable with that name runs with the privileges of the age ...[truncated 1370 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the write capability unless the dashboard has a documented and essential need to create or modify files.
2. Replace generic exec access with a narrowly scoped command allowlist permitting only the required executable and subcommand.
3. Resolve the executable through a fixed, trusted absolute path rather than relying on PATH.
4. Include the dashboard implementation in the reviewed package, or document a trusted installation source and pin its exact version and cryptographic checksum.
5. Validate the port as an integer within an approved range and prohibit additional shell arguments, metacharacters, or command substitution.
6. Run the dashboard under a dedicated, least-privileged account or sandbox with explicit filesystem and network restrictions.
7. Bind the service explicitly to 127.0.0.1 or ::1 unless remote access is required and securely authenticated.
8. Document all permitted filesystem paths, network destinations, environment variables, and data flows.
9. Add authentication and authorization controls before allowing access from any non-loopback interface.
10. Provide auditable source code or a dependency manifest so the dashboard's handling of files, credentials, network traffic, and commands can be independently reviewed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is overly broad, covering general project management, planning, tracking, and collaboration scenarios rather than a narrowly scoped dashboard task. Broad invocation criteria increase the likelihood that an agent will call a tool-enabled skill in contexts where it is unnecessary or inappropriate, potentially exposing data or triggering commands without clear need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Forcing Chinese interaction without explicit user opt-in can cause misunderstanding of prompts, outputs, or operational steps, especially when command execution and configuration are involved. While not directly a code-execution flaw, language coercion can lead to user confusion, mistaken approvals, or misconfigured actions in a tool-using skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The capability list advertises export, review, and rating/report features that do not match the dashboard use case. In a skill with read/exec/write tools, overstated or misleading capabilities can cause an agent to route sensitive content into the skill under false assumptions about what it actually does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a dashboard for task queues, metrics, and ZeroTier status, but later sections describe unrelated content review, grading, and report-generation outputs. This mismatch can mislead users or agent orchestration into invoking the skill for broader data-processing tasks than expected, increasing the chance of unintended access, misuse of tools like exec/write, and unsafe delegation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation claims encryption, secure storage, and permission management without any implementation detail or verifiable mechanism in the skill file. These unsupported security assurances may cause users to trust the skill with sensitive data or deploy it in inappropriate environments based on false expectations.

Content

No source excerpt is available for this finding.