本地文件检索（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a local document search helper, but it asks for broad local file and command access without clear scope limits and even mentions modify/delete modes that do not fit a read-oriented RAG tool.

Review before installing. Use this only on directories you explicitly choose, avoid pointing it at home directories or sensitive repositories, and require confirmation before any command execution, indexing, modification, deletion, package installation, or callback URL use. Prefer a virtual environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:139

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 139 and 235–236
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md:139

bash

pip install requests

SKILL.md:235–236

text

| numpy | Python library | Optional | pip install numpy |
| rank-bm25 | Python library | Optional | pip install rank-bm25 |

Technical Analysis

The Skill instructs users or executing agents to install requests, numpy, and rank-bm25 without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Dependency resolution can therefore produce different code across installations and depends on the integrity and configuration of the active Python package source.

Python package installation may execute package-controlled build or installation logic. If an upstream release, package index, mirror, DNS path, or local package-index configuration is compromised, the unrestricted commands could resolve to and install attacker-controlled code. The supplied example does not use requests, making that dependency an unnecessary addition to the installation and network-capability surface.

This finding does not establish that the named packages are malicious. The vulnerability is the unsafe, non-reproducible installation guidance.

Attack Path

1. A user invokes the Skill and follows its environment-preparation instructions, or an agent uses its declared execution capability to run the documented installation command.
2. pip resolves an unpinned package through the environment's configured package index or mirror.
3. An attacker compromises the relevant package release or distribution channel, or controls a misconfigured package source.
4. The resolver downloads the attacker-controlled distribution because no approved version or hash is enforced.
5. Package installation or later import executes attacker-controlled code wit ...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove requests unless the Skill contains a documented and necessary use for it.
2. Pin every required dependency to a reviewed version, for example with exact == constraints.
3. Maintain dependencies in a lockfile or constraints file and require cryptographic hashes, such as through pip install --require-hashes.
4. Configure installation to use an explicitly approved HTTPS package index or an internally controlled mirror.
5. Review and update pinned dependencies through a controlled process that includes vulnerability and provenance checks.
6. Install dependencies in an isolated virtual environment using a non-privileged account.
7. Ensure documentation distinguishes mandatory dependencies from optional enhancements and explains why each package is needed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states it supports create/query/modify/delete-style operations but provides no safety guardrails, authorization checks, or warnings. In the context of a local-file retrieval skill with exec access, undocumented modification and deletion capabilities substantially raise the risk of destructive actions against user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples use generic commands like searching documents or building a knowledge base, but they do not define activation boundaries, path restrictions, or consent requirements. This makes it easier for an agent to interpret ordinary user text as authorization to scan broad local content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation is internally inconsistent: it states no API key is needed while also declaring a required LLM API dependency. This can mislead users about data flows, trust boundaries, and whether local content may be sent to an external model service, creating a disclosure risk during use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises MD+EXEC functionality on local files but omits a safety warning about command execution and filesystem access. Users may not understand that the skill can execute commands and inspect local content, increasing the risk of unsafe invocation and accidental exposure or modification of sensitive files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description is so broad that an agent may activate the skill for loosely related prompts without clear user intent. In a skill with read/exec/glob/grep capabilities, over-broad triggering increases the chance of unintended local file access or command execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.