AI技能创建指南（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.0

Overview

This skill is a skill-authoring guide, but it requests command-execution access that its Markdown-only workflow does not justify.

Review this skill before installing because it asks for command-execution authority that is not needed for its stated guide-only purpose. Prefer a version with exec removed, or run it only in an environment where commands require explicit approval and have limited filesystem access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:16

Finding

Unnecessary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-20 and SKILL.md:55-57
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

The skill declares access to the exec tool and identifies itself as an execution-enabled skill:

yaml

tools:
  - read
  - exec
  - glob
  - grep

markdown

### Availability Classification
- **Category**: MD+EXEC
- **Description**: A Markdown-based AI Skill that drives the Agent to perform skill-creation tasks through natural-language instructions

Technical Analysis

The documented functionality consists of guidance for designing and writing SKILL.md files. The package contains no scripts, and its workflow does not identify a legitimate operation that requires local command execution. Granting exec therefore exceeds the permissions required for the stated task and violates the principle of least privilege.

Execution-capable tools materially expand the security boundary of a documentation-only skill. If untrusted task content, generated instructions, or a future modification influences the agent into issuing a command, the unnecessary capability could turn a text-generation workflow into local code execution. The current file does not itself instruct the agent to execute a malicious command; the risk arises from exposing an execution channel that the documented workflow does not need.

Attack Path

1. The skill is loaded with its declared exec capability.
2. A user request, untrusted skill-creation example, or subsequently introduced instruction supplies command-like content.
3. The agent interprets that content as an action required to complete the task.
4. The agent invokes exec, even though command execution is unnecessary for the legitimate workflow.
5. The command runs with the operating-system privileges and filesystem access available to the hosting agent.

This exploitation path is conditional on the platform granting ...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool list and change the availability classification from MD+EXEC to a Markdown-only classification.
2. Retain only capabilities required by a documented workflow. Remove read, glob, and grep as well unless the skill is explicitly expected to inspect local project resources.
3. If command execution is added in a future version, document every permitted command and argument, apply explicit allowlists, reject shell metacharacters and untrusted command fragments, and require user confirmation before execution.
4. Run any necessary future commands in a restricted sandbox with minimal filesystem access, no inherited secrets, limited network access, and a non-privileged operating-system account.
5. Add a release-time validation check that compares declared tools against actual workflow requirements and rejects unused high-impact capabilities.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The metadata description is broad, repetitive, and loosely scoped, which can cause the agent to over-trigger this skill in unrelated development contexts. Because the skill also advertises automation/resource-planning behavior and references executable resources, ambiguous activation boundaries increase the chance that the agent loads and follows inappropriate instructions during unrelated tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill declares exec capability, yet the document provides no safety warning, approval model, or limitations on command execution. In an agent environment, this can normalize running shell commands or bundled scripts without making the user aware of system-side effects, increasing the risk of unintended file modification, environment changes, or misuse if the skill is over-triggered.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The guidance tells authors that description is the primary trigger mechanism, but it does not require guardrails such as explicit exclusions, boundaries, or negative examples. That design pattern can systematically produce overbroad trigger text, causing accidental activation and unintended instruction injection into workflows where the skill is not relevant.

Content

No source excerpt is available for this finding.