Security audit

监控器

Security checks for vulnerabilities and agentic risk

Overview

This monitoring skill is broadly aligned with operations work, but it asks for command execution and external/API-style authority without enough concrete limits.

Review this before installing if you intend to use it on real systems. Only allow it to run clearly specified read-only diagnostic commands unless you explicitly approve a change, keep API keys narrowly scoped, and avoid using it where broad file writes, deployment actions, or unattended scheduling could affect production data or services.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill explicitly advertises generic command execution for a monitoring-oriented capability without narrowing what commands may run or under which guardrails. In an agent context, broad exec access can be repurposed for arbitrary system actions, privilege misuse, or destructive operations if user-controlled monitoring definitions are translated into shell commands.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The documentation claims file write capability even though the manifested purpose is monitoring, which primarily implies observation rather than modification. Unnecessary write access increases the chance that the skill could alter configs, logs, or other files as a side effect of routine use or prompt injection.

Context-Inappropriate Capability

Medium

Confidence: 77% confidence
Finding: The skill advertises broad API integration without defining which services are in scope, what data may be sent, or how credentials are handled. In a monitoring skill, unconstrained outbound API use can exfiltrate monitored data, trigger unintended external actions, or allow the agent to interact with systems far beyond its stated purpose.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation guidance is so broad that the skill may be selected for many generic operational requests, increasing the chance it is invoked with excessive authority or in contexts the user did not intend. Overbroad routing is dangerous here because the skill also advertises exec and external interaction capabilities, magnifying the effect of accidental or adversarial triggering.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The phrase 'create monitors for anything' lacks operational constraints and encourages use outside safe, defined boundaries. In combination with the toolset and later claims of command execution, file handling, and API integration, this broad promise can justify unsafe expansion of behavior under vague user instructions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes impactful capabilities including file operations, API calls, and command execution without prominent warnings, approval requirements, or clear statements about side effects. This is especially risky because users may invoke the skill for routine monitoring while unintentionally granting it the basis to modify files, reach external systems, or execute commands on the host.

Static analysis

No suspicious patterns detected.