T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:174- Finding
Unnecessary Enumeration of Credential-Related Environment Variables
- Content
View full analysis
- Remediation
View remediation
Security audit
周报写作器基础版
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly fits a weekly-report helper, but it asks for broad command access and includes unclear data-flow and credential-environment checks that users should review before installing.
Install only if you are comfortable with the agent reading local Git history and possibly using command-line tools. Avoid running the environment-variable validation snippet, do not provide callback URLs or API keys unless you understand the destination, and ask the agent to confirm the exact repository, date range, and data sources before generating a report.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill declares exec capability in metadata but does not prominently warn users that natural-language use may lead to shell command execution. In an agent context, hidden or underexplained command execution materially raises the risk of unintended system interaction, especially when combined with broad triggers and Git/network instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The feature description says it can integrate Git commit records and task-system data but does not warn users that potentially sensitive repository history, ticket text, author names, and internal project details may be accessed and summarized. Without upfront notice and scoping guidance, users may expose confidential engineering data unintentionally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is invoked through broad natural-language requests with no strict scope boundaries, increasing the chance of accidental activation during ordinary conversation. Because the skill has read/exec/glob/grep capabilities and references Git/task integration, an unintended trigger could cause unnecessary command execution or data access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill markets itself as a local, personal-use reporting tool, but its interface and documentation also permit callback URLs, external APIs, and network-dependent behavior. This mismatch can mislead users into exposing report content, Git metadata, or task information to remote systems they did not expect to be involved.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The sample trigger phrase '请帮我生成标准周报' is a normal conversational request and overlaps heavily with benign chat. In an agent environment, that makes the skill easy to activate unintentionally, which is risky because the skill can inspect Git history and run commands to gather content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states that data is stored locally and implies privacy safety, while elsewhere declaring external API and network requirements. Contradictory security claims reduce informed consent and can cause users to supply sensitive work summaries, repository history, or credentials under false assumptions about locality.
- Content
Static analysis
No suspicious patterns detected.