T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:5- Finding
Unnecessary Unrestricted Command-Execution Capability
- Content
View full analysis
- Remediation
View remediation
Security audit
Macro Sentinel Free
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a macroeconomic briefing use case, but it requests broad command execution and describes scheduled web browsing and message pushing without clear scoped permissions or user controls.
Install only if you are comfortable with a scheduled agent browsing public finance sites and sending briefings. Prefer removing `exec`, aligning the declared tools with the actual browser/message workflow, requiring explicit recipient and schedule confirmation, and using HTTPS sources before enabling recurring runs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:125- Finding
Economic Data Sources Configured with Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The declared capability coverage includes extremely broad scene keywords such as general data analysis, report generation, statistical insight, and visualization. In systems that auto-select skills from keyword coverage, this can hijack unrelated tasks and cause the agent to browse external sites or prepare outbound reports when the user did not intend to use this skill.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The dependency section explicitly requires
browserandmessagetools even though they are absent from the manifest’s allowed-tools list. This is more serious than a generic documentation mismatch because it normalizes hidden browsing and outbound messaging capabilities, which could be granted by the hosting platform despite not being transparently declared in the skill header.- Content
Scope Creep
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill’s documented workflow says it will automatically browse websites and push briefings to users, but the manifest only declares
read exec. This permission mismatch is dangerous because reviewers and users may approve a skill believing it has narrower capabilities than its instructions actually require, creating hidden expectations for browsing or outbound actions once mapped onto a richer agent runtime.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description says the skill generates structured briefings and pushes them to users, but it does not prominently warn that this includes outbound messaging and automated scheduled delivery. That omission reduces informed consent and makes the skill more dangerous in agent environments where sending messages is a side-effecting action.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad natural-language requests like collecting macroeconomic data or generating a briefing, which can overlap with ordinary user intent. This can cause accidental invocation of the skill in unrelated contexts, especially in systems that route by semantic similarity, leading to unexpected browsing, data collection, or message delivery.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The scheduled payload uses a broad trigger message that could activate the skill without strong scoping or guardrails. In a scheduler-integrated agent, this increases the risk of unintended recurring execution, repeated web access, and unreviewed outbound briefing generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The text explicitly states “完全中文化表达，适配中文用户需求,” indicating a fixed language/locale behavior. There is no accompanying opt-in, language selection, or clear documentation that the skill is intentionally limited to a China-specific locale for compliance or regional reasons.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file says the free version does not provide multi-role scenario guidance, yet earlier sections include explicit scenarios for personal investors, market analysts, and finance students. This is an active contradiction within the documentation about what guidance the skill includes.
- Content