Java基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:39 AM UTC
• Version: 1.0.1

Overview

This appears to be a basic Java review helper, but it requests command execution access without clearly explaining when or why commands would run.

Review this skill before installing if your agent grants tool permissions automatically. It is not malicious on the inspected evidence, but install it only where command execution is sandboxed or requires explicit approval, and avoid using it on untrusted Java files that could contain prompt-like instructions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:37

Finding

Unnecessary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–40
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - write
  - exec

Technical Analysis

The Skill declares access to the exec tool even though its documented purpose is limited to reviewing or generating basic Java code. The documented workflow requires reading Java input and may justify writing generated output, but it does not describe compiling code, running tests, invoking system utilities, or performing any other operation that requires command execution.

This unnecessary capability violates the principle of least privilege. If untrusted Java source code or user-controlled content is interpreted as instructions by the hosting Agent, that content could attempt to induce the Agent to invoke exec. Whether exploitation succeeds depends on the hosting platform's tool-call controls and confirmation policies, but the declared permission unnecessarily exposes a command-execution channel.

No malicious command, executable script, remote payload, persistence mechanism, or credential-access behavior was found in the audited project. The finding concerns excessive authorization rather than evidence that commands are currently executed.

Attack Path

1. An attacker supplies Java source code or related review input containing adversarial instructions.
2. The Skill processes that untrusted content in the Agent's instruction context.
3. The adversarial content attempts to persuade the Agent to invoke the declared exec tool.
4. If the hosting platform does not enforce sufficient confirmation, sandboxing, or command restrictions, the Agent executes a local command with its available process privileges.
5. The command may access or modify resources available to the Agent process, subject to operating-system and sandbox restrictions.

Impact Assessment

Successful exploitat ...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool list because it is not required by the documented static-review workflow:

   yaml

   tools:
     - read
     - write
   

2. Remove write as well if the Skill only needs to return review results through the Agent response and does not need to modify project files.

3. If compilation or test execution is added later, expose it through a narrowly scoped operation rather than unrestricted shell execution.

4. Run any required Java compiler or test process inside an isolated sandbox with:

   • A fixed allowlist of executables and arguments.
   • No shell interpolation.
   • Restricted filesystem mounts.
   • Disabled or restricted network access.
   • Resource and execution-time limits.
   • Explicit user approval before execution.

5. Treat reviewed source code and file contents as untrusted data. Ensure the hosting Agent does not interpret instructions embedded in source files as authorization to invoke tools.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest grants write and exec permissions without clearly warning users that the skill may modify files or run commands. For a code-review skill, this is especially dangerous because users may expect passive analysis, while the declared capabilities would allow active filesystem changes or command execution if the skill or platform behavior is abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill declares exec capability for a Java code review skill whose documented purpose is primarily analysis and suggestion generation. That creates unnecessary command-execution authority, increasing the blast radius if the skill is triggered on untrusted paths or later extended to run shell commands against user-supplied input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown tells users to '在AI Agent对话中调用本技能' but does not define what exact phrases, commands, or conditions should activate the skill. Without explicit trigger scope or negative examples, the invocation condition is ambiguous and may lead to unintended activation in general Java-related conversations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation repeatedly frames this as a limited 'basic' Java review skill and explicitly says advanced capabilities are unsupported. However, elsewhere the file advertises exec capability and includes an error case for '命令执行失败', which suggests operational behavior beyond pure review/generation guidance and conflicts with the constrained intent presented to users.

Content

No source excerpt is available for this finding.