Security audit

主题样式师

Security checks for vulnerabilities and agentic risk

Overview

This theme-styling skill is not malicious, but it asks for broad command, file, browser, and credential-related authority with unclear limits.

Install only if you are comfortable with an agent using this skill to read and write local design files and potentially run CSS/toolchain commands. Before use, keep it limited to presentation, document, report, and HTML theming tasks; do not provide API keys unless a specific trusted integration truly requires them; and confirm output paths, dependency installs, network font/CDN access, and overwrites explicitly.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document states both that no extra API key is required and later that some features do require API keys. This contradiction can cause operators or downstream agents to mis-handle secret setup, trust incorrect execution paths, or prompt users for credentials unnecessarily. In a skill with exec/browser/write capabilities, unclear credential expectations increase the chance of unsafe secret collection and operational misuse.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill first narrows its scope to theme styling tasks, then later expands into broad operational behavior and generic troubleshooting. Scope contradictions matter because agents may invoke the skill outside its intended domain, increasing the chance that powerful tools like exec, browser, and write are used for unrelated actions with weaker user expectations or review. This is not direct code execution abuse by itself, but it weakens safety boundaries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The declared tool set includes exec, read, write, and browser, and the surrounding guidance extends beyond design output into generic command, network, and API workflows. For a styling skill, that is excessive authority and ambiguous operational guidance, which can let the skill be repurposed to execute commands, fetch remote content, or alter files beyond what users expect. The mismatch between business purpose and available capabilities materially raises abuse potential.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The applicability section broadens the skill to general development, operations, and content-creation scenarios, far beyond theme styling. Overly broad invocation criteria encourage an agent to apply this skill in contexts where its powerful tools may perform unrelated actions, making accidental overreach or privilege misuse more likely. Broad scope is especially risky when the skill already advertises command execution and file generation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The markdown describes generating files and using command execution, but it does not pair those behaviors with clear user-facing warnings about filesystem changes, external dependency installation, network access, or potential overwrite effects. In an agent setting, this can cause silent side effects that users did not explicitly authorize. The danger is amplified because write/exec/browser can affect local state and pull external resources.

Static analysis

No suspicious patterns detected.