Security audit

谷歌字体工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Google Fonts helper, but it declares broader triggers and tool access than font guidance needs.

Install only if you are comfortable with a converted Markdown skill whose stated Google Fonts purpose is broader than its trigger and tool metadata. Prefer using it only for explicit font loading, typography pairing, CSS fallback stacks, and frontend font-performance tasks; avoid letting it auto-activate for general writing or marketing work.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a narrowly scoped Google Fonts helper, but these sections introduce generic CRUD/import/export/save semantics that are unrelated to font guidance. That scope drift can mislead an agent into applying the skill in broader contexts and normalizing unsafe assumptions about stateful or file-affecting operations, especially because the manifest also enables exec/write/browser tools.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The trigger conditions say to invoke the skill for marketing copy, title optimization, and content creation, which directly contradicts the stated Google Fonts purpose. Overbroad and mismatched triggers are dangerous because they can cause unintended invocation in unrelated sessions, exposing browser/exec/write capabilities when the user did not request a font tool.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The manifest grants browser capability even though the documented behavior is primarily Markdown guidance and code generation for font loading. Unnecessary tool grants expand the attack surface and increase the chance of unintended network access or data exposure if the skill is invoked inappropriately.

Vague Triggers

High

Confidence: 98% confidence
Finding: The trigger description is extremely broad and unrelated to the skill's domain, making accidental or excessive invocation likely. In the context of a skill with exec/write/browser permissions, that mismatch is materially risky because a general content-creation request could unnecessarily activate more powerful tooling than the task warrants.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest description uses broad invocation language around code generation, debugging, development, and deployment without clearly limiting the skill to font-related tasks. That imprecision can cause an agent selector to overmatch this skill, increasing the chance that privileged tools are made available in contexts where they are unnecessary.

Static analysis

No suspicious patterns detected.