网络监控免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.2

Overview

The skill is a plausible personal website monitor, but it asks agents to create persistent scheduled jobs and store SMTP credentials without enough safeguards or rollback guidance.

Review before installing. Use it only for targets you are authorized to probe, avoid sensitive internal URLs unless you explicitly intend to monitor them from this machine, do not store real SMTP passwords in plain config files, and do not add the cron/systemd timer unless you also know how to inspect and remove it later.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:259

Finding

Persistent Monitoring Through Cron or a User-Level Systemd Timer

Content

View full analysis

~/.config/systemd/user/ping-monitor.timer << 'EOF' [Unit] Description=Ping Monitor # ... [Timer] OnBootSec=1min OnUnitActiveSec=1min # ... [Install] WantedBy=timers.target EOF ``` A second scheduling instruction appears in the quick-start procedure: ```bash # 每分钟执行监控 crontab -e # 添加: * * * * * python ~/.py ``` ### Technical Analysis The instructions establish recurring execution that survives the original Skill invocation and future login sessions. Continuous scheduling is relevant to the declared availability-monitoring functionality, and the recommended systemd timer is user-scoped rather than system-wide. It therefore does not inherently require elevated privileges. However, persistence is presented as a routine setup step without: - Explicit confirmation immediately before modifying persistent scheduler configuration. - Duplicate-entry prevention or other idempotency controls. - Verification of the scheduled script's ownership and integrity. - An absolute, trusted Python interpreter path. - Disable, removal, or rollback instructions. - A complete corresponding systemd service definition. - Reconciliation with the document's later statement that the minimum monitoring interval is five minutes. The cron entry executes a mutable file in the user's home directory every minute. If that file is replaced or modified, cron will automatically execute the new content with the affected user's privileges. The abbreviated quick-start entry referencing `~/.py` is also incomplete and may lead users to schedule an unintended file. ### Attack Path 1. A user follows the Skill instructions and adds the cron entry or enables the user-level syst ...[truncated 1043 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:329

Finding

SMTP Password Stored in Plaintext Configuration

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:484

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition says to use this skill for broad data analysis, report generation, statistical insight, and visualization, which is much wider than the declared network-monitoring purpose. In an agent setting, an overly broad trigger can cause the skill to activate in unrelated contexts and then use exec/file-writing behavior unexpectedly, increasing the chance of inappropriate command execution or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file presents the display name, summary, instructions, examples, and output conventions entirely in Chinese, but does not state that the skill is region-specific or offer any language/locale choice. This can violate language or locale policy when users or host environments expect neutral or user-selectable language behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes HTTP checks and email alerts but does not clearly warn that monitored URLs, hosts, status data, and alert content may be transmitted to external systems over the network. That omission matters because users may supply internal endpoints or operational metadata, and an agent using this skill could disclose sensitive infrastructure details through outbound requests or email notifications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest/table says the free version does not support 'API 监控' and reserves it for PRO, but the documented code implements check_api_health(url, expected_response=None) that performs HTTP checks and validates JSON response content. That is a concrete API health-monitoring capability beyond simple website up/down checks described for the free edition.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The cron example instructs the user/agent to establish recurring execution, which is a real persistence mechanism. In an agent context, persistence is dangerous because it changes system state beyond the current session, can continue generating network traffic or alerts indefinitely, and may be abused to maintain unauthorized ongoing activity on the host.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

设置定时任务持续监控.

bash

# Linux/macOS: crontab 配置
crontab -e
# ...
# 添加每分钟监控
* * * * * python ~/.ping-monitor/monitor.py

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start instructions create directories and write persistent configuration/data files under the user's home directory, but the skill description does not clearly warn about that stateful behavior. In an agent environment, undisclosed local writes and persistent artifacts are security-relevant because they can modify the host environment, leave residual sensitive target information on disk, and surprise users who expected read-only assistance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The initialization step creates a durable application directory and configuration file in the user's home directory, which is a form of persistent state. While less severe than cron-based persistence, it still modifies the environment and stores monitoring targets and settings on disk, which can expose operational details or surprise users if done implicitly by an agent.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

Step 1: 初始化监控配置

bash

mkdir -p ~/.ping-monitor/data
cat > ~/.ping-monitor/config.json << 'EOF'
{
  "targets": [

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This quick-start step again directs creation of a cron-based recurring job, which constitutes persistence on the local system. Recommending persistence without strong warnings or consent gating is risky for agent-executed skills because it can leave behind long-lived automation that users did not fully intend.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

bash

# 每分钟执行监控
crontab -e
# 添加: * * * * * python ~/.py

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill explicitly performs outbound HTTP health checks to user-specified targets, which is a real external-transmission capability. In context this is the intended function of a monitoring tool, but it is still security-relevant because an agent can be induced to contact arbitrary internal or external endpoints, potentially exposing network metadata or participating in SSRF-like probing from the host where it runs.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md

# ...
  - name: API 服务
    type: http
    url: https://api.myservice.com/health
    expected_response:
      status: ok
    timeout: 5

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill is described primarily as a lightweight monitoring tool with ping/HTTP checks, email alerts, statistics, and basic visualization. However, the capability sections broadly advertise create/query/export, modify/reset/import, and export/save/convert operations without tying them to monitoring data, which expands the apparent behavior beyond the focused free-monitoring scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation states '免费版无需外部 API Key', which suggests no external credential dependency, but immediately documents SMTP host/user/password and alert email configuration for a core advertised feature: email alerting. While SMTP is not literally an API key, the surrounding dependency guidance downplays the need for external credentials to use a stated capability.

Content

No source excerpt is available for this finding.