智能缓存工具-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:39 AM UTC
• Version: 1.0.1

Overview

This cache skill is not plainly malicious, but it depends on installing and running an unpinned external package and leaves network, file, and cache-mutation behavior under-scoped.

Review this before installing. Use an isolated virtual environment, pin and verify the `smart-cache` package before running it, and require explicit user approval for package installation, network callbacks/API requests, cache deletion or clearing, and save/load paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:225

Finding

Unpinned and Unaudited Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225 and 339
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable code snippets:

bash

pip install smart-cache

text

| smart-cache | Cache library | Required | pip install smart-cache |

Technical Analysis

The skill directs the user or agent to install smart-cache without specifying an exact version, package hash, trusted index, verified publisher, or lockfile. Because the project consists only of SKILL.md and contains no local implementation of its advertised cache functionality, the effective runtime behavior depends entirely on code retrieved from an external package repository.

An unpinned installation may resolve to a package release that differs from the version originally reviewed. If the package, publisher account, or package repository is compromised—or if the package identity is incorrect—the installation or subsequent import can execute attacker-controlled code. The skill also declares access to the exec tool, increasing the likelihood that an agent could perform the installation rather than merely present it as documentation.

This finding establishes insecure dependency handling, but the audited artifact does not prove that the current smart-cache package is malicious.

Attack Path

1. A user invokes the skill and follows its installation instructions, or an agent uses its declared exec capability.
2. The command pip install smart-cache queries the configured Python package index.
3. Pip resolves the current package release because no version or integrity hash is specified.
4. A compromised, replaced, or otherwise unsafe release is downloaded and installed.
5. Package-controlled behavior runs during installation or when smart_cache is imported.
6. Malicious package code executes with the privileges of the user or agent process.

Im

...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than installing the latest available release.
2. Publish a lockfile or hashed requirements file and install with integrity verification, such as pip install --require-hashes -r requirements.txt.
3. Document the canonical package repository, publisher identity, and expected package hashes.
4. Prefer an auditable implementation shipped within the project when feasible.
5. Require explicit user approval before invoking package installation through exec.
6. Install and run the dependency in an isolated virtual environment or sandbox with restricted filesystem and network access.
7. Add dependency scanning and periodic package-provenance verification to the release process.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims it is purely local and does not involve external API calls, but example code performs HTTP requests via requests.get(). That contradiction is dangerous because users and calling agents may grant trust, routing, or policy exceptions under the assumption that no outbound network activity occurs, enabling unexpected data egress or SSRF-like behavior if adapted to user-controlled URLs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is described as a local cache-management tool, but its interface and examples broaden behavior into generic agent-driven operations, including callback URLs and operational workflows beyond simple caching. In an agent context, this mismatch can cause unsafe invocation, over-broad trust, and use of powerful tools such as exec for tasks the user did not reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation advertises destructive operations such as delete, clear, save_to_disk, and load_from_disk without warning about data loss, overwrite risk, or the need for confirmation. In an agent environment, undocumented destructive behavior can lead to accidental cache wipes, stale-state restoration, or overwriting local files when users believe they are performing harmless cache inspection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Advertising natural-language triggering without warning that actions may delete cache entries, clear state, or write to disk creates an unsafe ambiguity boundary. Users may issue casual requests expecting analysis or status output, while the agent interprets them as authorization to perform mutating operations, resulting in unintended local changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger-condition section reframes a cache tool as suitable for data analysis, reporting, and visualization tasks, which materially broadens when an agent may invoke it. In practice this can cause the skill to be selected for unrelated prompts and then exercise file or execution capabilities outside user expectations, increasing the chance of unsafe or unnecessary actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and capability sections consistently present the free version's strategy support as LRU/LFU only. Later examples and parameter documentation add FIFO/fifo as an available strategy, which materially expands the documented feature set beyond what the manifest claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The display name, summary, and the full skill instructions are written in Chinese, with no statement that users may choose another language. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.