Security audit

文本人性化工具

Security checks for vulnerabilities and agentic risk

Overview

This text-rewriting skill is mostly a Markdown prompt, but it asks for command execution and file-writing abilities that are broader than its stated purpose.

Review before installing. This does not show exfiltration or destructive intent, but a simple rewriting skill should not normally need shell access or broad write capability. Install only if you are comfortable granting those abilities, or prefer a version that removes exec/write and keeps the skill to text transformation.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill presents itself as a pure Markdown text-humanization tool, yet its manifest and documentation expose exec/write capabilities that are not necessary for rewriting text. This mismatch increases attack surface and can mislead users or orchestration layers into granting dangerous privileges to a low-risk-looking skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Command execution is unjustified for a personal text rewriting skill and creates a direct path to arbitrary shell actions if the agent interprets the skill operationally. In this context, even benign troubleshooting guidance like running ping normalizes command use and can be repurposed for harmful local or network operations.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill includes network-oriented operational guidance despite having no legitimate network requirement for text humanization. This broadens the effective behavior of the skill from content editing to environment probing, which can be abused for reconnaissance or unnecessary outbound activity.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: Stating that the tool is 'pure Markdown instructions' while also declaring command execution is a trust-breaking inconsistency. Users and automated systems may treat the skill as non-executable and grant it less scrutiny, while it actually retains the ability to run commands.

Static analysis

No suspicious patterns detected.