生产力增强工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.2

Overview

This productivity skill is not clearly malicious, but it requests broad read/write/command access with vague automation instructions and little scoping or user control.

Review this skill before installing. Use it only in a constrained workspace, avoid granting unrestricted shell execution unless you need it, and require explicit confirmation before it writes files, deletes or modifies data, installs packages, or runs network commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:141

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 141
Vulnerability Type: Unpinned third-party package installation
Risk Level: Low

Vulnerable Code:

bash

pip install requests

Technical Analysis

The environment preparation instructions install requests without specifying an exact version, package hash, or trusted package index. Consequently, the installed artifact depends on mutable package-index state and the local pip configuration at installation time.

The dependency is also unnecessary for the documented example, which uses only Python standard-library functionality. The dependency table identifies only the agent-provided LLM API as required and does not identify requests as a required runtime component. Installing an unused package needlessly increases the software supply-chain attack surface.

This instruction does not itself prove that the legitimate requests package is malicious. The risk arises if the configured index, mirror, package resolution process, or a future compatible release is compromised or otherwise untrusted.

Attack Path

1. A user or agent follows the Skill's environment preparation instructions.
2. The environment executes pip install requests.
3. pip resolves the package through its configured index or mirror without enforcing a reviewed version and cryptographic hash.
4. If that package source or resolution path is compromised, a malicious distribution may be selected.
5. Attacker-controlled package installation logic executes with the privileges of the user or agent running pip.
6. The malicious package may subsequently affect that Python environment and any processes that import or execute it.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account running the installation. Accessible scope may include files, environment variables, credentials, and network resources available to that ...[truncated 417 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install requests instruction because the documented task-manager example requires only Python's standard library.
2. If the package becomes necessary, declare it in a reviewed dependency manifest and pin an approved exact version.
3. Require cryptographic hashes, such as through pip install --require-hashes -r requirements.txt.
4. Use an explicitly approved package index or internally controlled mirror rather than relying on ambient pip configuration.
5. Install dependencies in an isolated virtual environment under a non-privileged account.
6. Add automated dependency and provenance scanning to detect vulnerable, substituted, or unexpected artifacts.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises read, write, and exec capabilities together with create/query/modify/delete style operations, but provides no warning, consent flow, or boundary on what files or commands may be touched. Because the skill is framed as a generic productivity helper, a user may invoke it for harmless-seeming requests while the agent performs state-changing filesystem or shell actions with significant side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill uses very broad trigger examples such as planning tasks, analyzing a week, and automating daily reports, which overlap heavily with ordinary user requests. In an agent ecosystem, this can cause the skill to activate unexpectedly and route routine requests into a capability set that includes read/write/exec access, increasing the chance of unintended tool use.

Content

No source excerpt is available for this finding.