Security audit

周报写作器基础版

Security checks across malware telemetry and agentic risk

Overview

This weekly report skill is mostly purpose-aligned, but it under-explains when work data, Git history, task data, API keys, callbacks, or external APIs may be used.

Install only if you are comfortable with the agent reading local work context such as Git history and possibly task data. Before use, keep report generation scoped to specific repositories or files, avoid callback_url unless you trust the endpoint, and do not let it send internal project details to external APIs without explicit confirmation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill markets itself as a local, privacy-preserving FREE weekly report tool, but also documents callback URLs, external API use, and network-dependent features. This mismatch can mislead users and agents into sending potentially sensitive work-report, git, or task data off-host without informed consent.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The document explicitly claims that FREE version data is stored locally and not uploaded to the cloud, while elsewhere stating that some features require external API and network access. For a reporting tool that may process internal project status, commits, and risks, this contradiction creates a serious trust and privacy problem because users may disclose sensitive operational data under false assumptions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill says users can trigger operations through broad natural-language requests without defining narrow activation boundaries. In an agent environment with exec/read/grep/glob capabilities, generic triggering increases the chance that ordinary conversation causes unintended data collection or command execution against local repositories and files.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The example trigger phrase '请帮我生成标准周报' is overly generic and can easily overlap with ordinary assistant usage. In a tool-enabled agent, this ambiguity can activate the skill unexpectedly and lead to filesystem reads, git inspection, or downstream networked processing without the user's clear understanding that a privileged skill was invoked.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises integration of git/task data and command execution capability, but does not provide a clear warning that it may inspect local repositories, process work artifacts, or perform system actions. Because weekly reports often summarize sensitive internal work, insufficient disclosure can cause accidental exposure of confidential project details or credentials embedded in local context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.