T08 · Insecure Dependencies
Warning
- Location
SKILL.md:369- Finding
Unpinned and Unidentified Automatic npm Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
论文写作助手免费版
Security checks for vulnerabilities and agentic risk
Overview
This thesis-writing skill is mostly aligned with academic writing, but it requests shell/file access and describes automatic npm installation without enough package or consent controls.
Review this skill carefully before installing. It is not clearly malicious, but only use it in a constrained workspace, avoid letting it install npm packages automatically unless the exact package and version are reviewed, and confirm any file-reading or shell-command action before it runs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest advertises broad marketing-copy, title-optimization, and generic content-creation use cases, but the documented behavior is thesis-oriented. This mismatch can cause the agent to invoke a skill in contexts beyond its actual scope, increasing the chance of inappropriate tool use and misleading users about what actions the skill may perform.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation language is overly broad and overlaps with generic writing requests such as marketing copy and content creation. In an agent environment, ambiguous triggers can cause this skill to activate for unrelated prompts, increasing the likelihood of unnecessary exec/file operations and confusing skill-selection behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The capability-coverage section claims support for essentially all description keywords, including marketing-copy and enterprise workflow scenarios, even though the command set only documents thesis-related functions. Overclaiming coverage can bias routing and trust decisions, leading the agent to apply this skill in unsafe or irrelevant situations and potentially expose local files through unnecessary tool invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The keyword-coverage section lists vague, expansive trigger terms without clear constraints, which can encourage over-broad skill activation. Because the skill exposes read, glob, grep, and exec tools, ambiguous routing is more dangerous here than in a pure text-only skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares MD+EXEC operation and supports file-based commands, yet it does not present a clear user-facing warning that local files may be read or that shell commands may be executed. In this context, lack of disclosure is dangerous because users may provide prompts expecting harmless writing help while the agent gains access to local documents and command execution pathways.
- Content
Static analysis
No suspicious patterns detected.