T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:18- Finding
Excessive Tool Permissions for a Guidance-Only Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
模型切换工具(免费版)
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a model-selection guide, but it asks for broader execution and file-write authority than its stated purpose needs.
Install only if you are comfortable with a guidance skill that declares command execution and file-writing authority. Prefer using it as a reference document or in a sandboxed environment, and do not allow it to run commands or modify files unless you explicitly request and review that action.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill says it auto-activates and recommends models based on keywords and task complexity, but elsewhere states the free version only supports manual switching. Contradictory control semantics can mislead orchestrators and users about whether the skill acts autonomously, which is dangerous when the skill has read/write/exec tools and broad triggers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrase covers broad terms like model switching, cost optimization, sub-agent dispatch, and scheduled-task model choice, all of which commonly appear in normal AI-development conversations. Such expansive triggers create prompt-scope capture risk, where this skill may inappropriately intercept unrelated requests and steer behavior or tool usage outside its intended niche.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest presents this as a narrow model-switching guidance skill, but the body expands into generic create/query/modify/delete/export/save behaviors and structured execution semantics. That scope mismatch can cause the agent or user to treat the skill as authorized for broader actions than advertised, increasing the chance of unintended file manipulation or unsafe tool use under a misleading description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger description says to use the skill whenever AI model calling, intelligent dialogue, agent orchestration, or LLM applications are involved, which is so broad that it overlaps with a large share of normal assistant usage. In context, this is more dangerous because the skill also advertises exec/write-capable behavior and inconsistent scope, making accidental over-application more likely.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The free-version description focuses on model-selection guidance, but these sections claim broader capabilities such as memory/reminders, chat, and simple file operations. This discrepancy weakens least-privilege expectations and may cause the skill to be invoked for unrelated tasks where tool use is unnecessary or riskier than users would infer from the metadata.
- Content