技能免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This skill is a basic skill-review assistant, but it asks for command execution and write access and includes an under-explained callback URL that could send review data outward.

Review this carefully before installing. It appears to be a legitimate basic skill-vetting guide, but it should not need broad command execution or write permissions for the documented workflow. Avoid using callback_url with sensitive review content unless the destination and transmitted data are clearly controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Excessive Agent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-16
Vulnerability Type: Excessive command-execution and filesystem-write permissions
Risk Level: Medium

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares read, exec, and write capabilities, but its documented workflow only requires inspecting files and returning an audit report. It defines no legitimate command-execution or filesystem-modification operation. The exec and write permissions therefore exceed the task's functional requirements and violate the principle of least privilege.

Because the skill analyzes potentially untrusted skill files, their contents may include adversarial instructions. If the hosting agent does not maintain a strict boundary between inspected content and trusted instructions, the unnecessary permissions could turn an instruction-handling failure into command execution or filesystem modification.

Attack Path

1. An attacker creates a skill containing adversarial instructions disguised as content to be audited.
2. A user asks this vetter to inspect the attacker's skill.
3. The agent reads the hostile content as part of the required review.
4. The content attempts to redirect the agent into invoking its available tools.
5. If the agent fails to treat the inspected content strictly as untrusted data, the declared exec capability can run local commands, while write can create or modify accessible files.

This path depends on an instruction-boundary failure in the hosting agent; the declaration itself does not automatically execute commands.

Impact Assessment

Successful exploitation could permit arbitrary commands within the hosting agent's execution context and modification of files available to that context. The practical scope is limited by the operating-system identity, sandbox, workspace restrictions, and approval controls applied by the host platform. No evidenc ...[truncated 92 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec and write from the declared tool list and retain only read.
• If reports must be persisted, grant narrowly scoped write access to one explicit report directory rather than general write capability.
• Require explicit user approval before any command execution or file modification.
• Treat all reviewed skill content as untrusted data and prohibit instructions found in target files from changing the vetter's goals or invoking tools.
• Document the permitted file scope and prevent access outside the target skill directory unless separately authorized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name, summary, and summary_zh are presented in Chinese, and the broader document is primarily Chinese, without stating that users may choose another language or that the locale restriction is required for a region-specific purpose. This can violate a language/locale policy when no opt-in or documented justification is provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown/manifest content says the skill is suitable for general development scenarios needing 'skill vetter related capabilities' and reusable templates, but it does not define specific invocation phrases, scope boundaries, or exclusion conditions. That broad wording could overlap with many ordinary development requests and cause unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises a callback_url parameter for asynchronous completion without any warning about outbound requests, data minimization, authentication, or privacy implications. In a tool-enabled agent context with exec/write/read permissions, users may supply sensitive review content that could later be transmitted to an external endpoint, creating data exfiltration or privacy risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The instructions tell users to invoke the skill in an AI Agent conversation with necessary parameters, but they do not specify the exact trigger conditions or the kinds of requests that should or should not activate the skill. In markdown guidance, this lack of specificity can lead to overbroad use or accidental invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.