Security audit

LLM助手中枢

Security checks across malware telemetry and agentic risk

Overview

This is mainly a document-analysis skill, but it requests command execution and file-changing powers while also saying it is pure Markdown and needs no tools, so it should be reviewed before installation.

Review this skill before installing. Its document-analysis instructions are not inherently harmful, but the requested exec/write/search powers and inconsistent API-key guidance are broader than the stated purpose. Prefer a version that removes exec and write, narrows activation to long-document review and comparison, and clearly states whether any credentials, network calls, callbacks, or file writes are ever needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill claims to be pure Markdown requiring no command execution, yet the manifest grants exec/write/read/glob/grep and later sections discuss API calls and command execution. This mismatch can cause operators or users to trust the skill as low-risk while it actually has materially higher system and data access, increasing the chance of unsafe deployment or overbroad approval.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document gives contradictory guidance on API key requirements, stating both that no extra API key is needed and that some features require API keys. Such inconsistency can lead users to misconfigure secrets handling, paste credentials into prompts or files, or misunderstand what external services the skill may access.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The declared capabilities include command execution and filesystem modification even though the stated purpose is document reasoning and analysis. Unnecessary powerful tools violate least privilege and expand the blast radius from a text-analysis skill into potential local command execution, file tampering, and secret exposure if the skill is triggered inappropriately or influenced by untrusted input.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation guidance is so broad that it overlaps with generic AI-assistant tasks, making the skill likely to trigger in many contexts beyond its intended use. In the presence of over-privileged tools, broad matching increases the chance that powerful capabilities are invoked when a safer generic assistant response would have been sufficient.

Vague Triggers

Low

Confidence: 75% confidence
Finding: The tags contain many generic terms, which makes the skill's activation scope ambiguous and may cause unnecessary or accidental selection. By itself this is low severity, but it becomes more relevant because the skill also declares risky tools that should not be attached to broadly matched contexts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes command, file, network, and credential-related operations without a clear upfront warning about system or data impact. Users may engage the skill expecting harmless document analysis, while hidden operational behaviors could involve reading local files, writing outputs, handling secrets, or invoking external services.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.