Security audit

智能体

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad AI-agent helper that asks for powerful local file and command tools without clearly limiting when or how they should be used.

Review before installing. This does not show malicious code, but it would give an agent broad read/write/search/command authority for a loosely defined AI-agent helper. Install only in an environment where command execution and file changes are acceptable, and prefer a version that defines exact allowed commands, user approval requirements, and data/API boundaries.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises general execute() capability while simultaneously claiming command execution is restricted to a whitelist, but the document provides no actual whitelist, enforcement mechanism, or scope limitation. In an agent context with read/write/exec tools, this mismatch can mislead operators into granting trust and enable arbitrary command execution paths under the guise of a safer control model.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is presented as a minimal multi-agent grouping tool, but the documented capabilities expand to file operations, external API access, and system command execution. This capability sprawl increases the chance that users or orchestration systems invoke the skill in low-risk contexts while unknowingly authorizing high-risk actions, violating least privilege and expanding attack surface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: System command execution is a high-risk capability that is not clearly justified by the stated purpose of simple multi-agent orchestration. In this context, broad exec access is more dangerous because the skill also exposes file read/write and can be used on generic AI tasks, creating a plausible path to local command abuse, data exfiltration, or environment manipulation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The invocation guidance is so broad that the skill may be selected for many generic AI, LLM, or agent-related requests rather than a tightly bounded use case. Because this skill includes powerful tools like exec, read, and write, overbroad matching materially increases the risk of unnecessary activation and unintended exposure of privileged capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.