T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:13- Finding
Excessive Command Execution and File-Write Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
个性化学习助手免费版
Security checks for vulnerabilities and agentic risk
Overview
This learning-assistant skill is not clearly malicious, but it asks for command execution, file writing, and callback URL handling that are broader than its tutoring purpose explains.
Install only if your agent platform asks for confirmation before running commands, writing files, or sending callback requests. For normal tutoring use, prefer a version limited to reading user-provided study material, and do not provide callback URLs or API keys unless you trust where the data will go.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description repeatedly claims broad applicability and reusable workflows without clearly constraining when the skill should be invoked. In an agent ecosystem, vague trigger scope can cause the skill to activate for unrelated tasks and gain access to powerful tools like read, write, and exec in contexts that do not require them, increasing the chance of misuse or unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents a callback_url parameter for asynchronous completion but provides no warning about sending results to external destinations or validating the target. That can lead users or agent frameworks to transmit prompts, outputs, or other sensitive data to attacker-controlled URLs, creating an exfiltration and SSRF-style risk depending on how the callback is implemented.
- Content