T06 · System Persistence
Error
- Location
SKILL.md:57- Finding
Persistent Scheduled Task Performs Unattended System Updates
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Update Agent Free
Security checks for vulnerabilities and agentic risk
Overview
This skill openly aims to automate updates, but it sets persistent unattended tasks that can modify the agent runtime and all installed skills without a strong approval or rollback boundary.
Install only if you intentionally want unattended daily changes to your agent runtime and every installed skill. Prefer changing the schedule to dry-run/report-only, approving updates manually, pinning versions or trusted publishers, and confirming you know how to remove the cron task before enabling it.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:87- Finding
Unpinned Automatic Runtime and Skill Supply-Chain Updates
- Content
View full analysis
> "$LOG_FILE" 2>&1 NEW=$(agent --version 2>/dev/null || echo "unknown") if [ "$CURRENT" != "$NEW" ]; then log "Agent运行时已更新：$CURRENT → $NEW" agent doctor >> "$LOG_FILE" 2>&1 else log "Agent运行时已是最新：$CURRENT" fi # 更新所有技能 log "检查技能更新..." skill registry update --all >> "$LOG_FILE" 2>&1 ``` ### Technical Analysis The workflow installs content from mutable upstream references: - The npm command selects the mutable `latest` release and modifies a global package. - The Git command pulls the current head of the mutable `main` branch. - The Skill command updates every installed Skill from the configured registry. No version pinning, commit pinning, cryptographic checksum verification, signature validation, publisher allowlist, package-lock enforcement, or mandatory review step is provided. The document states a “check first, then update” principle, but the scheduled message and supplied shell script invoke update operations directly. The dry-run command is therefore advisory rather than an enforced security boundary. The Skill also acknowledges that rollback backups, canary deployment, dependency-conflict analysis, and breaking-change detection are unavailable in this edition. This makes recovery and pre-installation risk detection materially weaker. ### Attack Path 1. An attacker compromises an authorized package publisher, source repository, Skill registry ...[truncated 1554 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The one-click setup tells the agent to create and enable a cron-based task that will keep executing in the future, but it does not clearly warn the user about persistent automatic execution or the fact that it will modify the runtime and skills. Because this is a low-friction natural-language trigger, a user could enable recurring system changes without understanding the long-term effects.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manual setup section includes a ready-to-run cron creation command that establishes persistent automatic execution and system updates, but it lacks an explicit safety notice about recurring behavior and software modification. This is especially risky because users may paste the command directly, creating an unattended update mechanism with minimal review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill promotes automatic daily updating of the runtime and installed skills without prominently warning that it performs persistent, system-modifying actions. In this context, the skill has exec capability and can alter software state over time, so insufficient disclosure increases the risk of users unknowingly authorizing recurring privileged changes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states a 'check before update' principle, but its documented automation path and included script perform real updates immediately rather than enforcing a dry-run/approval gate. This can cause unintended system changes, introduce breaking updates, or auto-apply unsafe package changes without explicit confirmation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The FAQ assures users that updates will not interrupt running tasks, yet the skill also updates the agent runtime itself, which may restart processes, change binaries, or affect sessions indirectly. This misleading safety claim can cause operators to schedule disruptive updates under false assumptions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The license/copyright section explicitly says the skill is '完全中文化表达，适配中文用户使用习惯', and the overall instructions are written exclusively in Chinese. There is no indication that users may choose another language or that the locale restriction is required for a region-specific compliance reason.
- Content