T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:19- Finding
Excessive Tool Permissions Enable Out-of-Scope System and Network Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Rust工具包-免费版
Security checks for vulnerabilities and agentic risk
Overview
This Rust helper is mostly learning guidance, but it asks for broad command and file access and can automatically run network diagnostics without clear user consent.
Review before installing. The skill does not show malware, persistence, credential theft, or remote code loading, but it should be treated carefully because it asks for command/file authority and tells the agent to run network checks automatically. Prefer installing only after removing exec/write permissions or requiring explicit approval and showing exact commands before any ping, firewall/proxy check, Cargo command, or file write.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A Rust learning/practices skill has no clear need to autonomously execute ping for network diagnosis and retry logic. Introducing command execution unrelated to the stated purpose expands the attack surface, can leak environment details, and normalizes unsafe side effects in what should be a knowledge-oriented assistant.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The capability is disproportionate to the advertised use case: a personal Rust study/helper tool should not perform system-level network diagnostics by default. Scope creep into host/network operations increases risk because users may invoke the skill expecting passive guidance while it performs active commands.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill describes running ping and retrying connectivity checks, but does not clearly warn users that it may execute host commands or initiate network traffic. Lack of explicit disclosure and consent for side effects is a security issue because users may unknowingly permit environment probing or command execution.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states that operations/deployment management is out of scope, but also prescribes firewall, proxy, and connectivity checks with retries. This contradiction undermines trust in the skill boundary and can cause agents to perform operational actions users did not expect from a Rust assistant.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are overly broad ('code generation, programming assistance, debugging testing, development deployment'), which can cause the skill to activate for many ordinary requests beyond Rust best-practice guidance. Overbroad activation is dangerous here because the skill also includes exec-enabled behavior, increasing the chance of unintended command or network actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims it does not involve external API calls and requires no API key, yet elsewhere instructs the agent to run network connectivity diagnostics. Even if ping is not an API call, it is still an external system/network action; this mismatch can mislead users and reviewers about the skill’s real behavior and mask unexpected command execution.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
文档标题、展示名称、描述与全部使用说明均以中文固定呈现，未说明是否支持其他语言，也未提供用户选择语言/locale 的机制。根据语言/locale 政策要求，若技能默认强制单一语言而没有用户选择或合理限制说明，属于自然语言策略问题。
- Content