Security audit

任务市场

Security checks for vulnerabilities and agentic risk

Overview

This skill is a payment-oriented marketplace guide, but it asks for broad command, file, API, and payment-related authority without clear limits.

Install only after reviewing the payment and authority model. Treat any task posting, bidding, wallet use, USDC payment, API key use, file modification, or shell command as requiring explicit user approval, and do not rely on the refund language unless the publisher documents how refunds are technically enforced.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation makes contradictory claims about its payment model: it says payments are direct peer-to-peer with no escrow or intermediary, yet later says users can cancel tasks and request refunds. In a payment-oriented skill, this inconsistency can mislead users and downstream agents about trust boundaries, dispute handling, and fund recovery, which may cause unsafe financial decisions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill is labeled as a Markdown-only natural-language skill, but other sections describe command execution, file handling, API use, and CLI behavior. This mismatch obscures the actual privilege and execution surface, increasing the risk that users or agents invoke it without understanding that it may perform side-effectful operations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file presents itself as an AI-agent job marketplace, but large portions describe generic workflow automation, file processing, API integration, and command execution. That scope drift makes the skill harder to reason about and can conceal risky capabilities behind an innocuous marketplace label, leading to overbroad trust by users or orchestrators.

Context-Inappropriate Capability

Low

Confidence: 81% confidence
Finding: System command execution is a high-risk capability, and the documentation does not clearly justify why it is needed for a marketplace skill. Even without explicit malicious commands, unjustified exec capability expands the attack surface and may encourage unsafe use in contexts where users expect simple marketplace interactions only.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation language is very broad, suggesting use whenever AI model calls, dialogue, orchestration, or LLM applications are needed. Such vague trigger conditions can cause the skill to be invoked in many unrelated contexts, increasing the chance that risky capabilities like exec or file operations are used unexpectedly.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Telling users to invoke the skill in any AI agent conversation creates ambiguous activation scope and normalizes indiscriminate use. In the presence of execution-oriented tools, that can lead to accidental invocation in sensitive sessions where the user did not intend command, file, or network actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The description emphasizes workflow benefits but does not clearly warn that the skill exposes command execution capability. Omitting this from the primary description can cause users or supervising agents to underestimate the operational risk and approve execution in contexts that require stricter review.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document mentions file handling/write-related behavior as part of its functionality without a clear warning about file modification risks. Hidden or underexplained write capability can lead to unintended changes to user data, configuration, or repository contents when the skill is invoked under an overly broad scope.

Static analysis

No suspicious patterns detected.