Security audit

Java代码

Security checks for vulnerabilities and agentic risk

Overview

This Java code review skill is not clearly malicious, but it asks for command execution and file-writing authority while its scope and safety controls are too broad and under-explained.

Install only if you are comfortable granting this skill command execution and file-writing capability in repositories you review. Prefer using it on a limited workspace or read-only copy unless the publisher narrows the trigger scope, documents allowed commands, and makes report writing the only default mutation.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims to prevent sensitive information leakage, but the manifest grants both command execution and file write capabilities without describing any concrete guardrails, sandboxing, redaction, or access controls. This mismatch can mislead users into trusting the skill with sensitive repositories while the agent still has the ability to read, transform, and potentially exfiltrate or persist sensitive data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: A Java code review report generator does not inherently require arbitrary shell command execution, yet the skill requests exec alongside read/write/glob/grep. If invoked broadly, this expands the attack surface from passive analysis into active system interaction, enabling unintended command execution, repository mutation, or access to local environment data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description uses very broad activation language covering code generation, programming help, debugging, testing, and deployment, far beyond simple Java review. In combination with powerful tools, this increases the chance the skill is auto-selected for unrelated developer tasks where exec/write abilities become riskier and less expected.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill exposes exec/write capabilities and mentions Git operations, but does not clearly warn users that it may run commands or modify files. This creates a consent and transparency problem: users may provide a repository for analysis expecting read-only behavior, while the skill has authority to change state or execute shell operations.

Static analysis

No suspicious patterns detected.