Security audit

YAML处理工具

Security checks across malware telemetry and agentic risk

Overview

This YAML skill is not clearly malicious, but it asks for broad read, write, and command execution authority while giving vague and partly mismatched usage instructions.

Review this skill before installing. It appears to be a generated YAML helper rather than malware, but its read/write/exec permissions are broader than its vague instructions justify. Use it only for YAML files you intend the agent to inspect or modify, and avoid letting it run commands or process unrelated translation/localization tasks unless the publisher narrows the scope.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill is presented as a YAML processing tool, but the description also instructs use for text translation, multilingual conversion, and localization. This scope mismatch can cause an agent to invoke the skill in unintended contexts and route unrelated user data into a tool with read/write/exec capabilities, increasing the chance of unsafe or overbroad execution.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The input/output contract is generic (`instruction`, `context`) rather than YAML-specific, which undermines any reliable boundary on what the skill may be asked to do. In practice, this makes the tool easier to misuse as a general-purpose agent wrapper instead of a scoped YAML utility, especially given the declared read/write/exec tool access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Overly broad and ambiguous invocation wording makes it unclear when the skill should or should not be used. For a skill with powerful capabilities like read/write/exec, vague activation criteria can lead to accidental invocation on unrelated requests, expanding access to files or command execution beyond the user’s actual intent.

Vague Triggers

Low

Confidence: 85% confidence
Finding: The getting-started guidance tells the agent/user to call the skill but does not specify concrete trigger phrases, required parameters, or guardrails. This weakens safe routing and increases the risk that the skill will be activated opportunistically or with incomplete context, which is risky because the skill advertises execution and file-access capabilities.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The skill description states support for Chinese interaction in a way that may steer behavior without user opt-in. While not a direct code-execution issue, forced language behavior can override user expectations, distort prompts, and contribute to unsafe tool routing or misunderstanding of sensitive instructions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.