Agent安全审计免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.2

Overview

This is a local security-audit helper that reads project files and runs simple search commands; the alarming strings are audit examples rather than hidden commands.

Install only if you want a Chinese-oriented local audit helper that can inspect the current project and run search commands. Review the commands before execution, especially scans touching .env or other secret-bearing files, and do not treat its simple pattern matching as a complete security assessment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (12)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "security-audit-agent-tool-free"
description: "AI Agent系统安全审计工具,支持代码库安全检查、提示注入检测与基础配置审计,适合个人开发者快速安全自查。Use when 需要安全检测、合规审计、漏洞扫描、加密防护时使用。不适用于渗透测试未授权目标。适用于独立开发者、企业团队和自动化工作流场景。支持中文交互，无需复杂配置即开即用。输出结果可直接使用，减少二次加工成本。"
license: Proprietary
allowed-tools: read exec
compatibility: "Requires LLM with tool-use capability"
metadata:
  displayName: "Agent安全审�

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The audit script explicitly reads .env files, which commonly contain secrets. While this is plausibly within an audit tool's purpose, it increases exposure of credentials to the agent runtime and command output; if results are echoed, logged, or transmitted, secrets could be disclosed.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

echo "=== Agent配置安全审计 ==="

# 检查配置文件
for config in config.json config.yaml .env agent_config.json settings.json; do
    if [ -f "$config" ]; then
        echo ""
        echo "--- 检查: ${config} ---"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

DANGEROUS_PATTERNS = [
        "rm -rf", "rmdir", "del /f", "DROP TABLE",
        "DELETE FROM", "shutdown", "reboot", "format",
        "chmod 777", "wget", "curl", "execute(", "JSON.parse("
    ]

    def check_tools(self, tools_config):

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md

### 提示注入常见模式
| 模式 | 风险等级 | 说明 |
|:-----|:---------|:-----|
| ignore previous instructions | 高 | 尝试覆盖系统提示 |
| you are now a... | 高 | 尝试角色劫持 |
| reveal system prompt | 中 | 尝试泄露系统提示 |
| disregard above | 高 | 尝试绕过约束 |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

|:-----|:---------|:-----|
| ignore previous instructions | 高 | 尝试覆盖系统提示 |
| you are now a... | 高 | 尝试角色劫持 |
| reveal system prompt | 中 | 尝试泄露系统提示 |
| disregard above | 高 | 尝试绕过约束 |
| new instructions | 中 | 尝试注入新指令 |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation text is broad enough to trigger on many generic security-related requests, which can cause the skill to activate in contexts the user did not specifically intend. For a skill with exec access, over-broad auto-invocation expands the chance of unnecessary command execution or sensitive repository inspection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description explicitly states '支持中文交互', and the rest of the file consistently presents the skill as Chinese-interaction oriented without saying users may choose another language. This can violate language/locale policy when a skill defaults users into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The core feature banner lists '本技能提供中文交互' as a built-in behavior, but it does not present language choice or an opt-in mechanism. This is a natural-language policy issue because it signals a fixed locale preference rather than accommodating user preference.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

DANGEROUS_PATTERNS = [
        "rm -rf", "rmdir", "del /f", "DROP TABLE",
        "DELETE FROM", "shutdown", "reboot", "format",
        "chmod 777", "wget", "curl", "execute(", "JSON.parse("
    ]

    def check_tools(self, tools_config):

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file states the free version is purely knowledge-driven and needs no extra API key, but elsewhere advertises API/service integration. Contradictory trust and deployment claims make it difficult for users to assess whether code, prompts, or findings remain local, which is a security-relevant property for an auditing tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented primarily as a local audit tool, but the documentation later claims external API integration and external service use. This inconsistency can mislead users and orchestration systems about the actual trust boundary and data flow, increasing the risk that sensitive code or findings are sent off-host unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation claims file writing capability even though the declared purpose is auditing and the manifest only allows read and exec. Claiming write behavior beyond the stated need can normalize broader filesystem modification and mislead users into granting or expecting unnecessary destructive capability.

Content

No source excerpt is available for this finding.