独立审计工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.2

Overview

This looks like an audit helper, but it requests command/write authority and optional external callbacks without clear limits or consent controls.

Install only if you are comfortable reviewing each run’s scope. Keep usage local and read-only by default, avoid callback_url unless you trust the destination and contents, and require explicit confirmation before any command execution, file writing, export, modification, or deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:145

Finding

Unnecessary Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 145
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code:

bash

pip install requests

Technical Analysis

The setup instructions install requests without pinning an exact version or verifying package hashes. Consequently, package resolution depends on mutable repository state and may produce different dependency versions over time. Running pip install also permits package installation logic from the resolved distribution to execute in the user's Python environment.

The documented audit sample does not import or use requests, so this installation adds supply-chain exposure without supporting the demonstrated local scanning functionality. No evidence indicates that the package name is typosquatted, that a malicious package is intentionally selected, or that an unsafe package index is configured; the risk arises from the unnecessary and non-reproducible installation instruction.

Attack Path

1. A user follows the environment preparation instructions in SKILL.md.
2. The user runs pip install requests.
3. pip resolves the current package and transitive dependency versions from its configured index.
4. If the configured index, resolved artifact, or dependency chain is compromised, malicious installation or runtime content may enter the Python environment.
5. That content executes with the operating-system privileges of the user running pip when installation or affected functionality triggers it.

This is a conditional supply-chain path; the audited project itself does not retrieve a remote executable payload beyond the ordinary package-installation process and does not demonstrate a compromised dependency.

Impact Assessment

Exploitation could execute code with the privileges of the account performing the installation. Depending on those privileges and the Python environment, pot ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install requests instruction because the documented scanner does not use that package.
2. If future functionality requires it, pin a reviewed exact version in a lock file rather than installing an unconstrained version.
3. Pin and review transitive dependencies and require cryptographic hashes, such as through a hash-locked requirements file.
4. Install only from an authenticated, explicitly configured trusted package index.
5. Perform installation in an isolated, non-privileged virtual environment.
6. Add automated dependency vulnerability and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares powerful operations including exec and write, and the body also mentions create/query/modify/delete workflows, but it does not warn users that these capabilities may execute commands or alter local data. This omission is dangerous because users may reasonably expect a passive audit tool, while the actual capability set permits state-changing or system-level actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation documentation describes scenarios like security audit, performance analysis, and compliance checking in vague terms without defining precise triggers, scope limits, or confirmation requirements. In an agent platform, this ambiguity can lead to accidental routing into a powerful skill with exec/write access, expanding the blast radius of ordinary conversational requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrase is broad and natural-language generic, which can cause the skill to activate in situations where the user did not explicitly intend to invoke this audit tool. Because the skill advertises read/exec/write capabilities, unintended invocation increases the chance of unnecessary file access or command execution in mixed-agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented callback_url parameter enables sending results to an external endpoint, but there is no privacy, trust, or data-handling warning. Audit results can contain source code fragments, secrets, paths, or security findings, so silent transmission to a callback target creates a real exfiltration and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill's display name, description, and all user-facing instructions are presented in Chinese, with no indication that users may choose another language or that the locale is intentionally restricted. This can violate language or locale policy where user-facing skills should not force a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.