Security audit

主动式代理

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it gives an agent broad proactive behavior, command/file authority, and persistent memory without enough user control.

Review this skill before installing. Use it only if you want an agent to persist user context and proactively use file, command, API, and memory workflows. Require explicit approval for shell commands, file writes, external calls, scheduled actions, and any persistent memory; avoid giving it secrets or sensitive personal data unless your platform provides clear memory inspection and deletion controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill simultaneously says not to execute unreviewed code and instructs the agent to try all available tools and run verification commands before reporting success. In practice, this creates pressure to execute repository code, tests, package scripts, or shell commands that may be attacker-controlled, which can lead to arbitrary command execution, secret exposure, or system modification.

Vague Triggers

High

Confidence: 88% confidence
Finding: The invocation description is so broad that the skill can be auto-selected for many generic AI, orchestration, and workflow scenarios. In an agent ecosystem, an over-broad trigger surface increases the chance that a write/exec-capable skill activates in contexts where the user did not intend system changes or command execution.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The scope description remains generic and lacks firm boundaries on when proactive behavior, memory use, or tool use is allowed. Because the skill includes exec and write capabilities, vague activation constraints can cause the agent to over-apply the skill and take actions beyond user expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The description does not clearly warn users that the skill can modify files, execute commands, and interact with external services, all of which can affect local state and remote systems. Missing safety disclosure undermines informed consent and raises the risk of unintended destructive actions or data exposure when the skill is invoked.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The WAL protocol instructs the agent to persist user preferences, decisions, deadlines, and corrections into memory before responding. Without strict minimization, consent, retention limits, and access controls, this creates a natural-language data retention channel that can store sensitive information across sessions and later disclose it in unrelated contexts.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The unified search design spans session state, long-term memory, working buffers, and external knowledge, which increases the chance that retained user data is surfaced too broadly. Cross-source retrieval can amplify accidental disclosure, especially when combined with proactive behavior and weak scoping around what information may be recalled or transmitted.

Static analysis

No suspicious patterns detected.