Security audit

生活助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local personal productivity assistant that stores task, schedule, note, and email-summary data on the user’s machine, with some broad but disclosed command/file capabilities.

Install only if you are comfortable with a skill creating and maintaining local personal-productivity files under $HOME/.assistant and with the agent being able to run simple shell commands for setup, backup, and diagnostics. Review stored task, note, reminder, and email-summary files periodically because they may contain personal or work-sensitive information.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill markets itself as local-only and non-automated, yet it declares command execution and provides network-oriented troubleshooting guidance. This mismatch can cause users or orchestrators to grant broader permissions than expected, increasing the chance of unintended command execution or network interaction under a misleading trust model.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Granting shell execution to a personal task and scheduling assistant materially expands the attack surface beyond its stated purpose. If prompted with adversarial or ambiguous input, the agent could create, alter, or inspect local files and run host commands unrelated to task management.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation says the free edition lacks automation workflows, while the skill classification explicitly includes Markdown-plus-execute behavior and shell-driven operations. This inconsistency weakens informed consent and can mislead policy engines or users into underestimating the skill's ability to perform automated host actions.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation scope is broad and open-ended, covering general project management, task planning, tracking, and collaboration without firm boundaries. Overbroad invocation criteria make accidental triggering more likely in contexts where file writes or command execution are unnecessary, raising the risk of privilege misuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The setup instructions create directories and files under the user's home directory, but the description does not clearly warn users up front that the skill persists data locally. Hidden persistence can expose personal schedules, notes, and email summaries to other local processes or later unintended reuse.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The examples discuss exporting and saving user data locally without an early warning about persistence. While less severe than active code execution issues, undisclosed storage of potentially sensitive personal data can still create privacy and retention risks.

Static analysis

No suspicious patterns detected.