系统控制器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed system administration helper, but its broad activation and high-impact system changes need review before installation.

Install only if you intentionally want an agent to help administer the host. Review every service, file, cron, environment, and sudo/admin action before execution, prefer dry-run or explicit confirmation, and avoid installing optional dependencies into a privileged or system Python environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:417

Finding

Unpinned Third-Party Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:417
Vulnerability Type: Unpinned and integrity-unverified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| psutil | Python package | Recommended | `pip install psutil` (enhanced process/resource queries) |

Technical Analysis

The Skill recommends installing psutil without specifying an audited version, validating package hashes, using a lock file, or explicitly restricting resolution to a trusted package index. The package version and installation artifacts can therefore change independently of the reviewed Skill.

Python package installation can execute package-controlled build or installation logic. If the selected distribution or configured package index is compromised, dependency resolution may introduce attacker-controlled code. This risk is amplified if installation is performed with elevated privileges, as the documentation elsewhere suggests using sudo or administrator access when permissions are insufficient.

The legitimate psutil package is not identified as malicious. The vulnerability is the mutable and integrity-unverified installation procedure.

Attack Path

1. A user or Agent follows the dependency instruction and runs pip install psutil.
2. Pip resolves the package using the environment's configured indexes and selects the latest compatible release.
3. An attacker compromises a resolved release, distribution artifact, package-index path, or relevant pip configuration.
4. Pip downloads the attacker-controlled artifact without checking a project-supplied expected hash.
5. Package-controlled installation or build logic executes with the privileges of the invoking account.
6. The attacker can modify files, access data, or establish further execution within the permissions available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution under ...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

• Pin psutil to a reviewed, known-good version rather than resolving an unconstrained latest release.
• Provide a dependency lock file or requirements file containing cryptographic hashes, and install with pip install --require-hashes.
• Explicitly use the official trusted package index and prevent unintended fallback to untrusted extra indexes.
• Install the dependency in a dedicated virtual environment using an unprivileged account.
• Do not use sudo pip install or install directly into the system Python environment.
• Periodically review and deliberately update the pinned version after checking release provenance, security advisories, and artifact hashes.
• Where practical, prefer operating-system package repositories with established signing and update controls.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords are extremely broad (e.g. 'file', 'system', 'control', 'manage') and are likely to activate in many ordinary conversations unrelated to system administration. In an EXEC-capable skill, overbroad auto-invocation increases the chance that the agent routes benign user requests into a high-privilege operational skill, which can lead to unnecessary command execution or destructive actions if follow-on instructions are ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The visible skill name and descriptive content are presented entirely in Chinese, with no indication that users may choose another language or locale. This can violate language or locale policy where skills should not impose a language without user opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding points to the same persistent file-write and rollback capability. Atomic writes and backups improve reliability, but they also make unauthorized configuration tampering more robust and durable if the skill is triggered inappropriately or used without strict scope controls.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

原子写入（防部分写入）

bash

sysctl-cli file write <path> --content "..." --atomic
sysctl-cli file write <path> --file source.txt --atomic

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

This duplicate finding points to the same persistent file-write and rollback capability. Atomic writes and backups improve reliability, but they also make unauthorized configuration tampering more robust and durable if the skill is triggered inappropriately or used without strict scope controls.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

原子写入(防部分写入)

bash

sysctl-cli file write <path> --content "..." --atomic
sysctl-cli file write <path> --file source.txt --atomic

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

md

| 症状 | 可能原因 | 处置 |
|:-----|:---------|:-----|
| `Permission denied` | 权限不足 | 使用 sudo 或以对应用户运行 |
| 服务 `active` 但实际无响应 | 状态不同步 | 用 `--deep` 检查，restart |
| 进程 kill 后 PID 复用 | 系统正常行为 | 用 PID 时即时操作，不要缓存 PID |
| `file write` 失败但原文件变了 | 非 atomic 模式中断 | 用 `--atomic`；从 snapshot 恢复 |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.

md

| 症状 | 可能原因 | 处置 |
|:-----|:---------|:-----|
| `Permission denied` | 权限不足 | 使用 sudo 或以对应用户运行 |
| 服务 `active` 但实际无响应 | 状态不同步 | 用 `--deep` 检查，restart |
| 进程 kill 后 PID 复用 | 系统正常行为 | 用 PID 时即时操作，不要缓存 PID |
| `file write` 失败但原文件变了 | 非 atomic 模式中断 | 用 `--atomic`；从 snapshot 恢复 |

Static analysis

No suspicious patterns detected.