T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:53- Finding
Excessive Command Execution and File-Write Capabilities
- Content
View full analysis
- Remediation
View remediation
Security audit
Web漏洞评估(免费版)
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a checklist-style web security helper, but it requests broad command and file-write authority and overstates automated assessment capability.
Review this before installing if your agent grants tool permissions automatically. Use it as a manual checklist aid, not proof that a web app was scanned. Avoid granting unrestricted command execution or file-write access unless you explicitly authorize a target, commands, and output location.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill declares exec and write capabilities and mentions optional external API use, but it does not prominently disclose when commands may run, files may be modified, or data may be sent off-host. In an agent environment, this can lead users to provide source code or targets without realizing the skill may execute commands or transmit sensitive assessment data externally.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill markets itself as broad web vulnerability assessment, but the included implementation only produces static checklists and templated reports rather than performing real analysis. This can mislead users into believing an application was actually assessed, causing false assurance and delayed remediation of real security issues.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation says the free edition is manual-checklist based, yet the code docstrings and structure imply it 'executes vulnerability assessment' and 'generates an assessment report' as though findings were derived from analysis. In a security context, this wording gap is dangerous because operators may trust synthetic results as evidence-based security testing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are so broad that the skill may activate for generic security, compliance, encryption, or detection requests beyond its actual capabilities. That increases the chance the agent routes users into this skill when more precise or safer tooling is needed, amplifying the false-assurance problem in sensitive security workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The display name, summary, and nearly all instructional content are in Chinese, and the file explicitly markets '中文修复建议' without stating that language is configurable or limited for a specific regional context. This can create a language-policy issue if the organization expects skills not to force a single language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.