审计

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.3

Overview

The skill is a simple knowledge-base audit instruction file, but it asks for command execution and write access without clear limits for a mostly read-oriented task.

Install only if you are comfortable granting the agent write and command-execution capability while using this skill. Prefer running it in a sandboxed project directory, do not provide sensitive documents or credentials, and require explicit confirmation before file changes, command execution, or any external API use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:20

Finding

Excessive Tool Permissions for a Read-Oriented Knowledge-Base Audit Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–23 and 195–205
Vulnerability Type: Excessive execution and write permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

The same file advertises capabilities beyond the stated read-oriented health-check purpose:

markdown

## Core Attributes
- **Automated execution**: Knowledge-base health checks for broken links, missing frontmatter, inconsistent tags, and covers
- **File processing**: Supports reading, parsing, and writing multiple file formats
- **API integration**: Calls external services through standardized interfaces and processes responses
- **Command execution**: Executes system commands in a secure sandbox and collects results

## Feature Description
Health check knowledge base
- **File processing**: Supports reading, parsing, and writing multiple file formats
- **API integration**: Calls external services through standardized interfaces and processes responses
- **Command execution**: Executes system commands in a secure sandbox and collects results

Technical Analysis

The Skill's declared purpose is to inspect a knowledge base for broken links, missing frontmatter, tag inconsistencies, and missing covers. Most of these operations only require read access. Nevertheless, the Skill requests exec and write tools and broadly advertises system-command execution and external API integration.

No specific commands, external endpoints, destination allowlists, writable path restrictions, or user-approval controls are defined. Consequently, an Agent that grants permissions based on this declaration may expose capabilities beyond those necessary for the legitimate task. This violates the principle of least privilege.

The reviewed file does not contain a concrete malicious command or payload. Exploitation therefore depends on the hosting Agent interpreting the broad capability declarations and subsequently processing malicious or ambig ...[truncated 1497 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unnecessary tool permissions and retain only read access for standard audits:

yaml

tools:
- read

2. Implement link validation through a narrowly scoped network capability rather than unrestricted command execution.
3. If command execution is essential, document the exact commands and arguments permitted, reject shell metacharacters, and execute through a fixed argument array rather than a shell.
4. Restrict execution to a sandbox with no access to credentials, user configuration, or files outside the supplied project directory.
5. Require explicit user confirmation before any command execution, file modification, or external transmission.
6. If automatic remediation is supported, expose it as a separate opt-in mode and constrain writes to validated paths inside project_dir.
7. Define an allowlist of protocols and destinations for external link checks, and prohibit transmission of private document contents or credentials.
8. Remove unsupported claims about API integration and command execution if those features are not actually required or implemented.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill should be used for broad security tasks such as security detection, compliance audit, vulnerability scanning, and encryption protection, even though the actual functionality appears limited to knowledge-base health checks. Overbroad activation language can cause an agent to invoke this skill in unrelated security-sensitive contexts, increasing the chance of unsafe command execution or file modification under false assumptions about capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises harmless-sounding audit behavior but omits an early, clear warning that it may write files and execute system commands, despite declaring read/exec/write tools. That mismatch can mislead users into granting or triggering powerful actions without informed consent, especially because the surrounding text frames the skill as a routine health check.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file states at L128 that the skill is classified as "MD+execute()" and at L199/L205 that it performs command execution, but later states at L214-L215 that it is pure Markdown ("MD") driven by natural language. These statements describe materially different operational behavior and capabilities, creating an intent-level contradiction in the skill's own documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states '支持中文交互' as a built-in behavior, and the document is primarily written to assume Chinese interaction, but it does not offer opt-in or a language choice. This can violate language/locale neutrality expectations when the skill is otherwise presented as generally applicable across platforms and users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The capability description and use cases at L42-L60 describe a knowledge-base checker for broken links, frontmatter, tags, and cover issues, but the sample output at L85-L106 reports generic items like "代码风格" and "安全合规" with scoring rather than the promised link/metadata findings. This is a documentation-level contradiction about what the skill returns to users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.