Security audit

舆情情绪分析专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill fits a stock/news sentiment-monitoring purpose, but needs Review because it asks agents to run commands, contact data and notification services, schedule recurring jobs, and write reports while its scope and installed implementation are unclear.

Install only if you are comfortable with an agent running command-line scripts, reading and writing report/config files, contacting financial/news APIs, and sending email or webhook alerts. Confirm the actual scripts and destinations before use, avoid broad automatic invocation, and do not enable scheduled/watch mode until you have reviewed how to stop it and where it stores outputs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill presents contradictory execution semantics: one section labels it as pure Markdown/natural-language driven, while the document elsewhere instructs the agent to run Python scripts and shell commands via exec. This misrepresentation can cause users or orchestrators to apply the wrong trust model and permission set, leading to unintended command execution in contexts where only passive documentation was expected.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document claims security and reliability safeguards such as boundary checks, safe command allowlists, and secure communications, but provides no code or enforceable mechanism showing those controls exist. Unsupported security claims can mislead users into trusting dangerous operations, especially because the skill advertises file handling, API integration, and command execution.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger description is broad enough to match generic analytics, reporting, visualization, and statistics requests, which increases the chance this skill is invoked outside its intended scope. Because the skill has read and exec capabilities, overbroad activation can route unrelated user tasks into a higher-risk execution path without clear user intent.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The manifest uses vague 'use when the user needs this capability' language without precise activation boundaries. Ambiguous scope alone is not directly exploitable, but in combination with exec-enabled behavior it raises the chance of accidental or automatic invocation for loosely related requests.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes report export features and shows commands that write JSON, CSV, HTML, and scheduled outputs to disk, but it does not prominently warn users that files will be created or overwritten. Hidden write behavior is risky in agent environments because it can alter local state, leak data into shared paths, or overwrite important files if paths are user-controlled or reused.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The dependency and configuration sections indicate access to external data sources, SMTP services, webhooks, and other network endpoints, but the skill does not clearly foreground that using it may initiate outbound network communication. In an agent setting, undisclosed network access can expose sensitive inputs, trigger external actions, or violate user expectations and policy boundaries.

Static analysis

No suspicious patterns detected.