Security audit

KAIFA辅助SKILL01

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed presentation generator that creates HTML and optional PPTX files, with no evidence of hidden data theft, destructive behavior, or persistence.

Install only if you are comfortable with a skill that can generate files in your workspace, run a local PPTX export script when requested, and load Google Fonts in rendered HTML. Review the generated outline before approving implementation, and avoid using it for confidential decks unless the external font dependency is removed or blocked.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill specification describes file reads, file writes, and shell execution without declaring any permissions or clearly constraining what paths and commands may be used. In an agent environment, this creates an unsafe capability gap: a seemingly harmless content-generation skill could access local files, overwrite outputs, or invoke arbitrary scripts if activated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 79% confidence
Finding: The documented behavior does not match the advertised purpose and trigger model, which undermines user and platform trust about what the skill will actually do. This kind of mismatch can cause unintended execution paths, surprise file generation, or invocation of export tooling beyond what a user reasonably consented to when asking for a simple HTML presentation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file claims to be a self-contained single-file presentation, but it loads fonts from Google Fonts at runtime. This creates an external network dependency that can leak access metadata, fail in offline or restricted environments, and weaken supply-chain/privacy expectations for a locally rendered presentation skill.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation, which raises the risk of accidental skill activation. Because this skill includes file generation and scripted processing, unintended activation could lead to unnecessary resource use, unwanted files, or execution of downstream tooling without clear user intent.

Vague Triggers

Low

Confidence: 72% confidence
Finding: Saying the user only needs to provide a few parameters while leaving activation boundaries undefined makes the skill easier to invoke unintentionally and harder to reason about safely. In context, this is primarily a safety and UX control issue rather than a direct exploit primitive, but it still increases the chance of unintended automation.

Static analysis

No suspicious patterns detected.