生活助手免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.3

Overview

This is a local personal assistant skill, but users should notice that it can run shell commands and write persistent personal data under their home directory.

Install only if you are comfortable with a local assistant keeping tasks, notes, preferences, and email summaries under $HOME/.assistant. Review commands before running them, back up any existing config before initialization, avoid putting secrets in the assistant data, and install optional Python dependencies in a virtual environment with pinned versions when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:337

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 337
Vulnerability Type: Unpinned dependency resolved from a mutable package registry
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| PyYAML | Python library | Optional | `pip install pyyaml` (parse configuration files) |

Technical Analysis

The documented installation command retrieves PyYAML without specifying a reviewed version or validating an integrity hash. Consequently, the package content installed by users may change over time despite the Skill itself remaining unchanged.

Package installation can execute distribution build or installation logic with the privileges of the invoking user. If the package registry, maintainer account, release process, or dependency chain were compromised, following this instruction could introduce attacker-controlled code into the local environment. The project provides no lock file, hash-pinned requirements file, trusted-index restriction, or isolated installation procedure to mitigate this supply-chain risk.

The package name is not an apparent typosquat, and the dependency is optional. No evidence establishes that the currently published package is malicious; the vulnerability is the unsafe, non-reproducible dependency installation practice.

Attack Path

1. An attacker compromises the relevant package publication channel, maintainer credentials, release pipeline, or a transitive build dependency.
2. The attacker publishes a malicious release that satisfies the unrestricted pip install pyyaml request.
3. A user or Agent follows the installation instruction in SKILL.md.
4. pip resolves and downloads the attacker-controlled release from the configured package index.
5. Malicious installation or runtime code executes in the Python environment with the privileges of the user running pip.
6. The payload can access resources available to that account and may affect subsequent processes ...[truncated 754 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyYAML to a specific version that has been reviewed and tested rather than installing the latest available release.

2. Provide a hash-locked requirements file and require integrity verification, for example:

   text

   PyYAML==<reviewed-version> --hash=sha256:<verified-distribution-hash>
   

   Install it with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate hashes separately for every supported platform and Python version, because wheel artifacts may differ.

4. Direct users to the official package index through an explicit trusted configuration and avoid unreviewed additional indexes.

5. Install the optional dependency inside a dedicated virtual environment using a non-privileged account. Do not recommend system-wide or administrator-level installation.

6. Add an update process requiring dependency review, vulnerability scanning, compatibility testing, and hash regeneration before changing the pinned version.

7. If YAML parsing is not needed for a given workflow, omit the optional dependency entirely to reduce the supply-chain attack surface.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation language is extremely broad, covering common project management, planning, tracking, and collaboration requests without clear scoping boundaries. In an agent ecosystem, overbroad matching can cause the skill to activate for many unrelated productivity tasks, increasing the chance it will gain access to local files or invoke exec/write behaviors when a narrower, safer skill would have been more appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states '支持中文交互' and the feature note also centers Chinese interaction, but there is no opt-in language choice or explanation that the skill is intentionally region-specific. This can violate language or locale policy by implicitly constraining the interaction language without user selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a personal task, communication, and schedule assistant with local storage, and the body repeatedly says the free version does not support external-service automation and stores data locally. However, the skill enables exec tooling and later documents network testing, HTTPS usage, and network error handling, which goes beyond a purely local assistant and conflicts with the stated free-version scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The functionality note explicitly lists Chinese interaction as a core capability, but does not indicate that users may select another language. Reiterating a fixed language expectation without opt-in increases the risk that the skill enforces a locale preference contrary to policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability coverage section lists a wide set of keywords as activation triggers, with little scope control and no safety gating. This kind of broad semantic capture can lead the agent to route many general requests into a skill that has exec/read/write access, unnecessarily expanding the blast radius of ordinary conversations into filesystem-modifying actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructions create directories and overwrite configuration data under the user's home directory without a clear warning or confirmation requirement. In an agent with exec/write capability, this can silently alter local state, clobber existing files, or seed persistent data stores in a way the user may not expect from a conversational productivity request.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The FAQ states all data is stored locally and not uploaded to the cloud, and the API key section says the free version needs no external API key. But the error handling and security sections discuss network connectivity, HTTPS, and API-key leakage precautions as if networked integrations are part of expected behavior, creating an intent-level contradiction in the documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description explicitly says the skill is suitable for automation workflow scenarios, while the free-version capability matrix later marks automated workflows as unsupported and reserved for PRO. This is a direct contradiction about the intended edition scope rather than a mere omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The backup example creates a tar.gz archive of the full assistant workspace, which may contain personal tasks, notes, and email summaries. The markdown does not warn that the archive will consolidate potentially sensitive local data into a shareable file, which has privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.