Security audit

效率追踪器基础版

Security checks for vulnerabilities and agentic risk

Overview

This productivity-tracking skill is not clearly malicious, but it asks for broad agent capabilities and makes inconsistent privacy and network-use claims that users should review before installing.

Review this skill before installing. Use it only if you are comfortable with a Markdown-only agent skill that may read local files, run shell commands, use APIs or callbacks, and create local report data. Avoid running the broad environment-variable check, and do not provide sensitive activity logs or API keys unless the data flow and output locations are clarified.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documentation states that all data is stored locally and not uploaded, but the skill also supports networked behavior such as external API access and callback URLs. This creates a deceptive trust boundary: users may provide sensitive productivity data under the assumption it never leaves the device, when the skill design permits outbound transmission.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The skill is presented as a limited personal productivity tracker, yet it declares broad exec capability and generic tool/API execution patterns that exceed the narrowly described feature set. That mismatch increases the chance the agent will perform unintended command execution or side-effecting operations under an overly trusted productivity label.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill includes instructions to enumerate environment variables matching API, KEY, TOKEN, or SECRET, which is unnecessary for a personal productivity tracker and directly exposes the presence of sensitive credentials. Even with masking in display output, this normalizes secret discovery behavior and can be adapted by an agent or downstream workflow into credential leakage or targeted exfiltration.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill again asserts that all data remains local and is not uploaded, while elsewhere it explicitly allows network access and API usage. Repeated contradictory privacy claims are dangerous because they materially mislead users about exposure of work logs, schedules, and behavior analytics, which may be sensitive personal or organizational data.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough to match generic requests about analysis, reports, statistics, or visualization, which can cause the skill to activate outside its intended scope. In a skill with exec and export capabilities, overbroad triggering increases the risk of the agent taking actions on unrelated user requests or sensitive local data without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The natural-language invocation guidance is ambiguous and invites the agent to infer actions from loosely phrased requests. Ambiguous activation is risky here because the skill can read files, search, and execute commands, so unclear intent may lead to unnecessary data access or operations beyond what the user expected.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents export operations and includes exec-backed tooling, but it does not clearly warn users that command execution or file/output side effects may occur. This omission undermines informed consent and may cause users to trigger writes, exports, or shell actions from what appears to be a harmless reporting tool.

Static analysis

No suspicious patterns detected.