Security audit

插件UI架构

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks an agent for broad file and command authority to install or alter SkillHub UI behavior while giving inconsistent and incomplete instructions.

Review this skill carefully before installing. Only use it in a disposable or version-controlled SkillHub environment, require the agent to show exact files and commands before any change, and do not provide API keys or credentials unless the missing installation materials and data flows are supplied and reviewed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill claims installation must be manual, yet elsewhere instructs an agent to read and execute installation steps automatically. This contradiction weakens operator expectations and can lead an agent to perform file or system modifications without an explicit, scoped approval boundary, increasing the risk of unintended or unsafe changes during installation.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill metadata advertises read, write, and exec capabilities, but later describes itself as pure Markdown guidance. This misrepresentation can cause users or supervising systems to underestimate the skill's ability to modify files or run commands, which is dangerous because the actual capability set includes impactful operations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The description is overly broad and muddled, mixing plugin architecture, UI design, branding, automation, and generic workflow claims without clear task boundaries. Ambiguous invocation criteria increase the chance that an agent applies the skill in inappropriate contexts and then uses its read/write/exec capabilities beyond what the user expected.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage example tells the agent to use the skill for a vaguely described 'task' without constraining what actions are allowed. In a skill that exposes file and command operations, this creates prompt-level overbreadth that could authorize unintended system changes, broad file access, or misuse of plugin installation behavior.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly advertises file handling, API integration, and command execution, but does not present clear, prominent warnings about the resulting data, credential, and system impact. In context, this is more dangerous because the skill is framed as a generic automation/UI helper, making high-impact behaviors easy to invoke without informed consent or safeguards.

Static analysis

No suspicious patterns detected.