Security audit

P2P通讯入门工具

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a P2P messaging guide, but it asks for broad agent powers and tells agents to use it for unrelated development tasks.

Install only if you are comfortable with an agent using command execution and file read/write capabilities for this skill. Treat it as a review item: restrict use to explicit P2P messaging/file-transfer tasks, avoid using it for generic coding or deployment work, and use a dedicated folder for received files and local history.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The manifest and description present the skill as a P2P/WebRTC messaging tool, but the activation guidance repurposes it for broad code generation, debugging, and deployment tasks. This scope mismatch can cause the agent to invoke a tool with exec/read/write permissions in situations unrelated to communications, increasing the chance of unintended command execution or misuse under false pretenses.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The capability coverage section claims support for code generation, programming assistance, debugging, and deployment, while the rest of the skill only documents P2P communication features. This inconsistency makes routing ambiguous and can trigger the skill for unrelated high-trust tasks, creating an opportunity for misuse of its broader tooling than users would expect.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill declares read, write, and exec capabilities even though its stated purpose is a narrow P2P messaging tool. Excessive permissions violate least privilege and become dangerous if the skill is mis-invoked or if downstream scripts/processes are influenced by untrusted inputs, because the agent gains filesystem and command execution reach beyond what users may anticipate.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation guidance is overly broad and unrelated to the narrow P2P domain, encouraging use during generic coding, testing, and deployment work. Ambiguous routing increases the likelihood that this skill will be selected in inappropriate contexts where its exec/read/write abilities create unnecessary risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The capability coverage section lists sprawling keywords and fragmented phrases, making activation conditions vague and overinclusive. In an agent environment, this can cause accidental selection of the skill for unrelated tasks, indirectly exposing powerful tooling and side effects to contexts where they are not justified.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documentation describes file transfer and local history storage but does not clearly warn users that data may be persisted locally or written to disk. In a communications tool, this can lead to unintentional storage of sensitive messages or received files, undermining user expectations about privacy and side effects.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The receive-file example writes incoming content to a local output directory without an explicit warning that this operation creates files on disk. Receiving remote content is especially sensitive because it introduces persistence and potential handling of untrusted files, which users should be clearly informed about before running the command.

Static analysis

No suspicious patterns detected.