夸克扫描-免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed image scanning and enhancement helper, but users should be careful because it uploads images to an external service and its trigger wording is broader than its actual image-only purpose.

Install only if you are comfortable sending selected images or documents to Quark Scan for processing. Use it only for the listed image enhancement scenes, avoid sensitive files unless approved, keep the API key protected, and install Python dependencies in an isolated environment with pinned versions when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:256

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:256
Vulnerability Type: Unpinned and non-reproducible third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| requests | Python library | Required | pip install requests |

Technical Analysis

The documentation instructs users to install requests without specifying an audited version, cryptographic hashes, a lockfile, or an explicit trusted package index. Consequently, the dependency and its transitive components may change after the Skill has been reviewed.

Although no malicious package is present in the audited project, this installation pattern creates a supply-chain exposure. If a future package release, transitive dependency, or configured package index is compromised, installation or subsequent use could execute attacker-controlled Python code. The risk is greater where users have configured an untrusted package mirror or run package installation with elevated privileges.

Attack Path

1. An attacker compromises a future release in the relevant dependency chain or causes the victim's Python package manager to use a malicious package index.
2. The user follows the Skill documentation and executes pip install requests.
3. Because no version or artifact hash is enforced, pip resolves and downloads the currently available package artifacts.
4. A malicious artifact is installed into the selected Python environment.
5. Attacker-controlled code executes during an applicable installation or runtime path with the privileges of the user running Python or pip.

Impact Assessment

Successful exploitation could provide code execution under the installing user's account. The accessible scope may include files, environment variables, API credentials, and network resources available to that account. If installation is performed as an administrator or root user, the impact could extend to system-wide Python ...[truncated 171 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to versions that have been reviewed.
2. Provide a lockfile or requirements file containing cryptographic hashes, and require hash verification during installation, for example with pip install --require-hashes -r requirements.txt.
3. Specify an approved HTTPS package index and warn users against untrusted mirrors or additional indexes.
4. Run installation and execution inside an isolated virtual environment under a non-privileged account.
5. Add automated dependency vulnerability and integrity scanning to the release process.
6. Periodically update the pinned versions through a controlled review and testing process rather than permitting unconstrained resolution at installation time.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is broad enough that an agent could invoke this skill for generic file handling, conversion, or content extraction tasks outside its narrowly described image-scanning purpose. Because the skill has read, write, and exec capabilities and sends user-supplied content to an external service, over-triggering increases the chance of unintended execution, privacy exposure, and use on mismatched tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill metadata and user-facing documentation are presented entirely in Chinese, including the display name and descriptive content, with no indication that the user can choose another language. For a general-purpose skill intended for multiple agent platforms, this can amount to a locale/language constraint without explicit opt-in or justification.

Content

No source excerpt is available for this finding.