Token经济学家(专业版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent token-cost optimization guide, but its recommended shared cross-session cache can reuse private prompts and responses across team members while understating that privacy risk.

Review this skill before installing in any team or enterprise setting. Disable shared caches by default unless you have explicit consent, tenant/project isolation, retention limits, deletion controls, and checks that prevent secrets or private prompts from being cached. Use isolated Python environments with pinned dependencies, store API keys in a secret manager, and configure Slack or CI integrations only with approved destinations and minimal data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:497

Finding

Cross-User Semantic Cache Can Expose Sensitive Query and Response Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:497, 572, 738
Vulnerability Type: Missing tenant isolation and unsafe cross-user cache sharing
Risk Level: High

Vulnerable Code Snippet

json

{
  "budget": {"monthly": 50.00, "alertThreshold": 0.8},
  "team": {"sharedCache": true, "reportFrequency": "weekly"}
}

The documentation also explicitly recommends cross-user cache reuse and states that the shared cache contains query-response pairs. It claims that omitting user identifiers from cache keys prevents privacy exposure, but this does not remove sensitive information from the cached queries or responses themselves.

Technical Analysis

The recommended team configuration enables sharedCache by default in the example. The cache is designed to store user queries and generated responses and return responses for semantically similar queries.

Omitting a user ID from the cache key does not provide confidentiality or authorization. Instead, it removes a possible isolation boundary. Queries and responses may contain proprietary source code, credentials, personal information, internal system details, or confidential business data. Hashing the query only obscures the lookup key; it does not sanitize or encrypt the cached value.

The documented design does not specify:

• Per-user, per-project, or per-tenant namespaces
• Authorization checks before returning cached content
• Secret or sensitive-data detection
• Encryption of cached values
• User consent for sharing generated content
• Cache deletion, retention, or expiration controls
• Protection against semantic matching across security boundaries

This exceeds the minimum privileges required for token optimization. Cost reduction and semantic caching can be implemented with user-isolated caches without allowing one team member to access content originating from another member.

Attack Path

1. A team administrator deploys the recommend ...[truncated 1492 chars]

Remediation

View remediation

Remediation Suggestions

1. Change all recommended configurations so that sharedCache defaults to false.
2. Partition caches by organization, project, user, data classification, and authorization context.
3. Include an authorization-scope identifier in the cache key and verify the caller's authorization before returning an entry.
4. Never share cache entries merely because two queries are semantically similar.
5. Detect and reject secrets, credentials, personal data, and other sensitive content before caching.
6. Encrypt cached content at rest and in transit using managed keys with appropriate access policies.
7. Apply short, configurable retention periods and provide explicit cache inspection and deletion controls.
8. Require informed administrator and user consent before enabling any cross-user sharing.
9. Record cache reads and writes in an audit log without logging the sensitive content itself.
10. Add security tests proving that users in different authorization scopes cannot retrieve one another's entries.
11. Correct the FAQ statement that shared query-response caches cannot leak privacy merely because user IDs are absent from cache keys.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:773

Finding

Unpinned Third-Party Python Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:773-776
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install sentence-transformers
pip install scikit-learn
pip install numpy
pip install prometheus-client

Technical Analysis

The installation instructions do not specify versions, package hashes, a lock file, or an approved package index. Consequently, each installation resolves whatever release and transitive dependency graph the configured Python package index supplies at installation time.

Python package installation can execute package build logic and install executable code under the privileges of the invoking user. The reviewed Skill does not itself contain malicious packages, and the named packages are not alleged to be malicious. The vulnerability is that the instructions provide no reproducible or cryptographically verified dependency set.

This allows the effective installed code to change after the Skill has been reviewed. Risks include:

• Compromise of an upstream package or maintainer account
• Compromise or misconfiguration of the selected package index
• Dependency confusion through an additional private or public index
• Introduction of a vulnerable or incompatible future release
• Unexpected changes in transitive dependencies
• Installation into a privileged or shared Python environment

Attack Path

1. A user follows the documented pip install commands.
2. pip queries the user's configured package indexes and resolves the latest compatible releases and transitive dependencies.
3. An upstream release, transitive dependency, or configured index supplies compromised or otherwise unsafe package content.
4. pip downloads the unverified package because no expected version or hash is enforced.
5. Package build or installation logic executes with the invoking user's privil ...[truncated 943 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive dependency to a reviewed version.
2. Publish a lock file generated from a controlled, reviewed environment.
3. Record and enforce package hashes, for example with pip install --require-hashes.
4. Specify the approved official or internal package index explicitly.
5. Avoid combining public and private indexes in a manner that permits dependency confusion.
6. Install packages inside a dedicated virtual environment or isolated container.
7. Never recommend installation as root or with unnecessary administrative privileges.
8. Scan locked dependencies for known vulnerabilities and license issues before release.
9. Establish a controlled process for reviewing and updating dependency versions.
10. Document verified installation commands that reference the reviewed lock file rather than mutable latest releases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Cross-session and team-shared caching can cause one user's prompts or responses to be reused for another session or another user, potentially exposing confidential context, business data, or sensitive generated output. The absence of an explicit warning or consent model increases the risk that operators will deploy it in privacy-sensitive environments without safeguards.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Cross-session shared semantic caching and LLM summarization normalize retention and reuse of user content beyond the originating interaction. In a tool explicitly designed for teams and shared caches, this raises real risks of sensitive prompt, response, or derived-context disclosure across users or over time if retention boundaries are unclear.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Member-level reporting and shared-cache guidance make it normal to expose individual usage patterns, spend, and potentially reused query/response material to other team members or managers. In many environments, this can reveal sensitive work activity, project focus, or content derived from private prompts if not tightly scoped and access-controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

LLM-based summarization implies forwarding conversation content to an LLM for processing, which may include secrets, code, internal discussions, or personal data. Without an explicit disclosure, users and operators may unknowingly send sensitive material to external or separate processing components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Sending budget and cost data to a Slack webhook is an external data transmission to a third-party system. Without a user-facing warning, administrators may unintentionally leak internal operational data, usage trends, or potentially tenant-specific information outside the primary environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims team-shared cache does not involve user identity information, yet elsewhere it explicitly supports per-member reporting and shared cache behavior tied to team members. This creates a misleading privacy assurance that can cause operators to enable cross-user reuse and analytics without understanding the actual scope of user-linked processing.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

Although framed as configuration advice, the text instructs users to keep API keys in a filesystem credentials directory. This is a sensitive-data handling instruction in natural language and increases the chance that secrets are persisted in ways the agent may later read, summarize, or expose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The license/changes section explicitly highlights '完全中文化表达', indicating a fixed language presentation. Under the policy, forcing a specific language without user choice is a natural-language policy issue unless the locale constraint is documented and justified or users are given an opt-in choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest and core description frame the skill as a token optimization/cost governance tool with structured workflows and configuration guidance. The documented behavior also includes sending Slack webhook alerts (L605-L612) and failing CI/CD pipelines based on budget checks (L614-L622), which are broader operational control/integration actions rather than core token-economist analysis itself. These capabilities may be useful, but they are not clearly scoped in the top-level description.

Content

No source excerpt is available for this finding.