Pro Comm Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

The skill is a mostly ordinary workplace writing template, but it asks for broad command execution and uses an unpinned installer without enough scoping or disclosure.

Review this skill before installing. It appears intended for workplace writing, not harmful activity, but install it only from a trusted source, prefer a pinned installer version, and avoid granting exec unless the runtime can require confirmation and restrict commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:138

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:138
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

bash

npx skillhub@latest install pro-comm-toolkit-free

Technical Analysis

The installation command instructs users to retrieve and execute the mutable latest release of the skillhub package. No exact version, package integrity hash, lockfile, registry restriction, or signature-verification procedure is specified.

Because the latest tag can be reassigned after this audit, the code ultimately executed by npx may differ from the reviewed version. Package command code and applicable lifecycle behavior run with the permissions of the user invoking npx. The project contains no evidence that the referenced package is currently malicious; the vulnerability is the unsafe and non-reproducible dependency acquisition process.

Attack Path

1. An attacker compromises the package publisher account, package registry entry, release pipeline, or another component controlling the latest release.
2. The attacker publishes a modified package and assigns it to the latest tag.
3. A user follows the documented installation command.
4. npx downloads and executes the attacker-controlled package version.
5. The package executes within the invoking user's security context and can access resources available to that account.

Impact Assessment

Successful exploitation could allow arbitrary command execution with the privileges of the user performing the installation. Depending on that user's permissions, the payload could read or modify user-accessible files, access credentials exposed to the process, establish network connections, or alter the user's development environment. System-wide impact would require the command to be run under an administrative account or otherwise elevated environment.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact package version, such as skillhub@X.Y.Z.
• Document the trusted package registry and prevent fallback to untrusted or user-controlled registries.
• Publish and verify a cryptographic checksum or package signature before execution.
• Use lockfiles or an equivalent immutable dependency manifest where the installation workflow supports them.
• Review package lifecycle scripts and CLI entry points before approving a new version.
• Perform upgrades through a controlled process rather than automatically tracking the mutable latest tag.
• Advise users not to run the installation command with administrator or root privileges.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary General Command-Execution Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permission
Risk Level: Medium

yaml

allowed-tools: read exec

Technical Analysis

The Skill requests unrestricted exec access even though its declared primary functions are generating workplace emails, meeting materials, instant messages, and plain-language explanations. These text-generation operations do not inherently require local command execution.

The document further characterizes the Skill as Markdown-driven at line 294, classifies it as requiring execution capability at line 309, and recommends invoking a network diagnostic command in its error guidance at line 321. A general-purpose shell is substantially broader than the limited connectivity diagnostic described by that guidance.

Granting exec expands the consequences of adversarial user content, prompt injection embedded in material being rewritten, or unsafe future changes to the Skill. Although no instruction in the reviewed file directly executes a malicious command, the permission violates least-privilege design because it exposes a local code-execution channel that is not necessary for the core task.

Attack Path

1. A user supplies untrusted content for rewriting, summarization, meeting preparation, or technical explanation.
2. That content contains instructions crafted to induce the Agent to invoke a command rather than treat the content solely as data.
3. The Agent fails to maintain the boundary between untrusted content and trusted Skill instructions.
4. Because the Skill is authorized to use exec, the Agent invokes a local command.
5. The command operates with the Agent process's permissions and can affect resources accessible to that process.

This path depends on a separate instruction-following failure or unsafe future instruction, but unnecessary exec authorization materially increases the resulting impact.

Impact Assessmen

...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from allowed-tools and retain only the minimum tools needed for text generation.
• Remove command-based network troubleshooting from the Skill because network diagnostics are unrelated to its core writing functions.
• If connectivity testing is genuinely required, expose a narrowly scoped diagnostic tool with fixed arguments instead of a general shell.
• Treat all user-provided and imported communication content as untrusted data and explicitly prohibit interpreting embedded content as tool instructions.
• Require interactive approval for any exceptional command invocation.
• Run the Agent under a restricted account and apply filesystem, process, and network sandboxing as defense in depth.
• Add tests confirming that writing and formatting requests cannot cause shell commands to be invoked.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability description for email templates explicitly states support for creation, query, and export operations, which implies users can create template-related content. Later FAQ text says the free version does not support custom template creation, creating a direct documentation-level contradiction about what '创建' means in this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation advertises export operations and allows exec, but does not tell users when files may be written or commands run. In a tool-using agent, that omission weakens informed consent and increases the risk of unexpected filesystem changes or shell execution from ambiguous prompts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The meeting capability description advertises creation support, while the FAQ later states that preset templates are provided and custom template creation is not supported in the free version. This is an active contradiction in the skill's own documentation about whether users can create templates or only use predefined ones.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is overly broad ('需要消息发送、通知推送、邮件短信、通信集成时使用'), which increases the chance of unintended activation in unrelated contexts. In an agent environment with tool access, mis-triggering can cause the model to invoke this skill unnecessarily, potentially leading to unwanted command execution, file output, or workflow interference.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install command uses npx skillhub@latest, which pulls and executes the newest package version without pinning. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that some functions require exec capability but provides no execution boundaries, approved command set, or risk disclosure. Because exec can invoke arbitrary shell commands, the lack of guardrails materially increases the chance of unsafe behavior if the skill is misused, mis-triggered, or later extended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

For a prose-explanation feature, 'query/export' may be plausible, but '创建' is ambiguous and conflicts with later documentation that the free version does not support custom template creation. The contradiction is in the intent conveyed by the docs, not in any executable behavior shown here.

Content

No source excerpt is available for this finding.