Mac 系统工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a disclosed macOS command helper, but it includes unsafe destructive deletion guidance and overly broad routing that could make an agent use it in the wrong situations.

Review this skill before installing. It is not malicious on the inspected evidence, but users should only enable it for explicit macOS system-management requests, avoid the documented Trash deletion command unless it is replaced with a validated absolute Trash path, and be careful with screenshot, clipboard, process-kill, and sudo-related actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:221

Finding

Unsafe Destructive Trash Deletion Using a Working-Directory-Relative Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 221
Vulnerability Type: Unsafe destructive file operation and ambiguous path handling
Risk Level: Medium

Vulnerable Code

markdown

| Clear Trash | `rm -rf ./.Trash/*` (confirm first) |

Technical Analysis

The skill recommends recursively and forcibly deleting ./.Trash/*. Because this path is relative to the agent's current working directory, it does not reliably identify the current user's macOS Trash directory. If the command runs from an unexpected or attacker-influenced directory containing a .Trash subdirectory, it can permanently delete unrelated files.

The use of rm -rf compounds the risk by recursively deleting content without normal recovery through macOS Trash and by suppressing many prompts and errors. Requiring confirmation before execution helps prevent accidental invocation, but it does not ensure that the deletion target is correct. The glob also excludes dot-prefixed entries within .Trash, making the advertised operation incomplete.

Attack Path

1. The user asks the agent to empty the macOS Trash.
2. The agent follows the skill and requests confirmation.
3. The user confirms while reasonably assuming the command targets the standard macOS Trash directory.
4. The agent executes rm -rf ./.Trash/* from its current working directory.
5. If that directory has an unrelated .Trash subdirectory, all matched content beneath it is recursively and permanently deleted.
6. Recovery through the normal macOS Trash interface is unavailable because rm directly unlinks the files.

An attacker able to influence the working directory or arrange sensitive files under its .Trash subdirectory could increase the likelihood and impact of unintended deletion.

Impact Assessment

The command executes with the privileges of the agent's operating-system process. It can permanently delete any matched files that account is permitted to remove. It does not independent ...[truncated 258 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use a working-directory-relative path for destructive deletion.
• Resolve the intended per-user Trash location to an absolute, canonical path and validate it immediately before execution.
• Reject the operation if the resolved target is absent, is a symbolic link, or differs from the expected Trash directory.
• Display the validated absolute path and a summary of the affected entries when requesting confirmation.
• Prefer a macOS-native Finder or System Events operation that preserves platform semantics instead of directly invoking rm -rf.
• If direct deletion is unavoidable, implement a dedicated script that uses safe path handling, checks ownership and directory type, prevents traversal or symlink redirection, and fails closed on validation errors.
• Avoid shell globbing for deletion targets. Enumerate and validate each target explicitly, including dot-prefixed entries where appropriate.
• Add post-operation reporting that identifies exactly which validated directory was processed and whether any entries failed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are unrelated to macOS system control and are overly broad, mentioning data analysis, reporting, statistics, and visualization. Overbroad routing criteria can cause an agent to invoke this exec-capable skill in inappropriate contexts, expanding the chance of command execution against user systems when another non-exec skill should have been used.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding points to the same dangerous pattern: a wildcard-based rm -rf command presented as a standard operation. In the context of an agent with exec access, such commands are highly abuse-prone because small path-resolution mistakes or prompt-injection-driven parameter changes can turn routine assistance into destructive file deletion.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

| 复制到剪贴板 | `echo x \| pbcopy` |
| 粘贴 | `pbpaste` |
| 打开 Finder | `open .` |
| 清空废纸篓 | `rm -rf ./.Trash/*`（先确认） |

## 安全操作规范

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding points to the same dangerous pattern: a wildcard-based rm -rf command presented as a standard operation. In the context of an agent with exec access, such commands are highly abuse-prone because small path-resolution mistakes or prompt-injection-driven parameter changes can turn routine assistance into destructive file deletion.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

| 复制到剪贴板 | `echo x \| pbcopy` |
| 粘贴 | `pbpaste` |
| 打开 Finder | `open .` |
| 清空废纸篓 | `rm -rf ./.Trash/*`(先确认) |

## 安全操作规范

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill’s user-facing name, description, instructions, examples, and operational guidance are entirely in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicit and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples normalize screenshot and clipboard operations without sufficiently foregrounding that these actions may capture passwords, tokens, personal messages, or confidential on-screen content. In an exec-enabled skill, weak warning language increases the risk of accidental collection or exposure of sensitive data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

1. 用户描述要做的系统操作.
2. 判断类别（查询/调整/破坏性）.
3. 查询类直接执行；破坏性先确认.
4. 需要 sudo 的提前告知.
**响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.
## 示例

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

1. 用户描述要做的系统操作.
2. 判断类别（查询/调整/破坏性）.
3. 查询类直接执行；破坏性先确认.
4. 需要 sudo 的提前告知.
**响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.
## 示例

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

1. 用户描述要做的系统操作.
2. 判断类别（查询/调整/破坏性）.
3. 查询类直接执行；破坏性先确认.
4. 需要 sudo 的提前告知.
**响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.
## 示例

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md

1. 用户描述要做的系统操作.
2. 判断类别（查询/调整/破坏性）.
3. 查询类直接执行；破坏性先确认.
4. 需要 sudo 的提前告知.
**响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.
## 示例

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md

1. 用户描述要做的系统操作.
2. 判断类别（查询/调整/破坏性）.
3. 查询类直接执行；破坏性先确认.
4. 需要 sudo 的提前告知.
**响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.
## 示例

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets the free edition as focused on personal read-only queries and basic control, yet it explicitly includes a destructive deletion command to empty Trash using rm -rf. This mismatch can mislead users and downstream agents into treating the skill as safer than it is, increasing the chance of unintended destructive execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

L155 states that scheduled tasks and automation strategies are not supported in the free version, yet the manifest tags/category at L017 and L027 label the skill as '自动化/Automation' and the document repeatedly describes executable operational flows. This creates a documentation-level intent inconsistency about whether automation is in scope for the free edition.

Content

No source excerpt is available for this finding.