Security audit

照片

Security checks for vulnerabilities and agentic risk

Overview

This webcam snapshot skill is not clearly malicious, but it asks for broad command and file access while giving incomplete scope and unsupported safety claims.

Review before installing. Only use this skill in an environment where command execution and file writes are acceptable, and prefer a revision that narrows the trigger to public webcam listing/snapshot retrieval, states exact allowed commands or safer APIs, and removes unsupported sandbox or allowlist claims.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill advertises that command execution is limited to a whitelist, yet the manifest exposes broad exec capability and provides no actual whitelist definition or enforcement mechanism. This creates a dangerous trust gap: an agent or user may rely on the stated safeguard and permit command execution in situations where arbitrary shell commands could be run.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation claims commands run in a 'safe sandbox', but the skill defines no sandbox boundary, isolation mechanism, or execution restrictions. False assurances about sandboxing are security-relevant because they can cause operators to approve risky workflows under the mistaken belief that host impact is contained.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance says to use the skill whenever the user needs 'photo-related' functionality, which is far broader than the skill's stated purpose of listing and retrieving webcam snapshots. In a skill that exposes exec/read/write/glob, an overly broad trigger can cause the agent to activate a more privileged skill in unrelated contexts, increasing the chance of misuse or unintended command/file operations.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The usage guidance is incomplete and ambiguous ('Use this skill when the user ...'), leaving scope undefined. Ambiguous routing criteria are risky here because the skill exposes powerful tools, so unclear invocation boundaries can lead the agent to select it for tasks beyond intended webcam retrieval and then perform unnecessary privileged actions.

Static analysis

No suspicious patterns detected.