Security audit

密码生成器

Security checks for vulnerabilities and agentic risk

Overview

This password-generator skill is not clearly malicious, but it asks for broad read/write/execute authority and describes unrelated security and automation capabilities that do not fit simple password generation.

Review this skill before installing. It should be limited to generating passwords, but its manifest and documentation request broad agent tools and describe unrelated security automation. Install only if you are comfortable granting those broad capabilities, or prefer a narrower password generator with no exec/write access and no API-key requirement.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented output format describes a generic audit/scoring report rather than a generated password, which is inconsistent with the skill’s stated purpose. This kind of mismatch can mislead an agent or operator about what the skill does, increasing the chance that the skill is invoked in broader security-analysis contexts or that downstream automation handles unexpected data unsafely.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest presents the skill as a password generator, but the body advertises unrelated capabilities such as CVE correlation, compliance auditing, risk scoring, and threat-intelligence alerting. This scope inflation is dangerous because it normalizes use outside the declared purpose and can justify unnecessary access, tool use, or trust in unsupported security workflows.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The scenarios and metrics expand into password storage, reset, and management workflows that are materially different from simple password generation. In an agent environment, this broadening can cause users or orchestrators to treat the skill as authorized for adjacent sensitive operations involving credential handling, retention, or account changes.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill declares execution-oriented behavior, LLM/API dependencies, and API-key configuration even though password generation can be performed locally without network or shell access. Unnecessary execution and secret-handling capabilities enlarge the attack surface, especially in agent platforms where declared capabilities may grant powerful runtime permissions.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The manifest includes read, exec, and write tools for a task that should only require local random string generation. Over-privileged tool declarations are dangerous because a compromised or misused skill could read sensitive files, write secrets to disk, or execute commands under the cover of a benign password-generation label.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The result-format section contradicts the stated function by specifying an evaluation report instead of password output. Contradictory documentation is dangerous in automated agent ecosystems because routing, validation, and downstream consumers may make incorrect assumptions, potentially causing unsafe chaining into unrelated security-review or reporting workflows.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation guidance is overly broad, telling agents to use the skill for generic efficiency, automation, batch processing, and workflow optimization rather than only for password generation. In an agent system, broad trigger language can cause accidental or policy-bypassing invocation of an over-privileged skill in unrelated contexts.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad and lack strong scope boundaries, increasing the chance that the skill is selected for loosely related credential or workflow tasks. Because the skill also declares powerful tools, ambiguous triggering materially raises the risk of unintended invocation in sensitive contexts.

Static analysis

No suspicious patterns detected.