Security audit

职场工作汇报

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly workplace advice, but it asks for command and write access that is not clearly needed or safely bounded.

Review before installing. The visible content is not destructive and contains no hidden code, but the skill should ideally remove exec/write or clearly limit them and require explicit consent before any file, API, or command action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The skill simultaneously claims to be pure Markdown that does not need exec while its manifest grants exec and other sections discuss command execution. This inconsistency can mislead users and reviewers about the real authority of the skill, increasing the chance that powerful capabilities are enabled without informed consent.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: A workplace-guidance skill later advertises file handling, API integration, and command execution capabilities unrelated to its stated advisory role. This capability creep expands the attack surface and can cause the agent to perform side-effecting operations users would not reasonably expect from a reporting/coaching skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The manifest grants command execution even though the described function is workplace guidance and reporting. Unnecessary exec access violates least privilege and creates a direct path for harmful system actions if the skill is invoked broadly or prompt-influenced into operational behavior.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill has write permission without a clear need for its advisory-only purpose. Unnecessary write capability can allow unintended file modification, persistence of sensitive content, or tampering with workspace artifacts despite user expectations of read-only guidance.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation text uses very broad conditions such as efficiency, automation, batch processing, and workflow optimization, which can match many unrelated requests. Combined with powerful tools, this increases the likelihood of accidental activation and unintended use of write or exec in contexts the user did not specifically request.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The usage instructions rely on generic natural-language descriptions rather than clear invocation boundaries or mode separation. This ambiguity makes it easier for the agent to interpret ordinary work requests as authorization to use the skill and potentially its privileged capabilities.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises file writes, API integration, and command execution without prominent warnings about consequences or user approval expectations. Users may engage the skill for harmless workplace advice while being unaware that it can perform external or system-affecting actions.

Static analysis

No suspicious patterns detected.