Security audit

Java代码审查免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Java code review prompt, but it requests write/exec-capable authority while its scope is broader and less consistent than a review-only tool should be.

Install only if you want a Chinese-language Java review assistant and are comfortable with it being available during broad development prompts. Prefer using it on explicit Java diff/source review requests, and avoid granting write access unless you specifically want the agent to edit files or save reports.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger language is extremely broad ('use when code generation, programming assistance, debugging/testing, development deployment') and overlaps with many general development requests. In an agent ecosystem, overly broad activation criteria are dangerous because they can cause the skill to be selected in contexts it was not designed for, exposing exec/write permissions and expanding the opportunity for prompt-driven misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description explicitly advertises '支持中文交互', and the document is written to operate in Chinese without offering a language choice. Per policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is clearly optional or justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is presented as a Java code review tool, but the body expands into generic create/query/modify/delete, import/export, and save/convert operations unrelated to review. That scope expansion is dangerous because agents may grant or invoke broader behaviors than users expect, increasing the chance of unauthorized file manipulation or command-driven actions when paired with exec/write-capable tooling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: L76-L80 say the skill is not suitable for '运维部署管理', but L83 says it should be used when '开发部署' is needed. This is an active contradiction in the skill's own guidance about intended use, which can mislead an agent into invoking it outside its declared scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation description remains ambiguous and lacks precise activation phrases or strong exclusions, which makes accidental or policy-bypassing invocation more likely. Because the skill also declares powerful tools, ambiguity increases the chance that normal development prompts route into a higher-risk skill unnecessarily.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L444 states that an 'LLM API' is required, while L447 says the tool is '纯 Markdown 指令驱动，无需额外 API Key'. These statements present conflicting operational intent: one describes dependence on API-backed model access, the other frames the tool as not needing such external configuration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest advertises a review/report skill, but later sections claim API calls, multi-interface data aggregation, network-dependent automation, and broad command execution efficiency gains. In context, this overstates capability and can mislead an agent or operator into treating the skill as authorized for networked or automated workflows beyond code review, increasing attack surface and the risk of unintended command or data-handling behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.