Security audit

Minimal Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a powerful system-control agent that openly supports arbitrary command execution and automatic fallback into that mode, so users should review it carefully before installing.

Install only if you intentionally want a high-privilege local automation agent. Prefer function or force_function mode, avoid auto and mixed mode on sensitive systems, verify the external system-controller dependency before use, and run it under a restricted account or sandbox where possible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: try: # 执行任意命令 result = subprocess.run( command_str, shell=True, capture_output=True,
Confidence: 99% confidence
Finding: This function executes attacker-controlled strings with shell=True, giving the skill unrestricted arbitrary command execution on the host. In the context of an OS-control agent, that means prompt/tool input can become full shell access, enabling file deletion, malware execution, persistence, credential theft, or lateral movement.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill declares powerful shell-like capabilities and repeatedly states that in V1/text mode it can execute any system command, yet no explicit permission model is declared. This creates a capability/consent gap where a user or orchestrator may treat the skill as lower-risk than it actually is, increasing the chance of arbitrary command execution in an over-privileged context.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description frames the skill as a system-controller-based Windows control agent, but the body expands behavior to unrestricted command execution, arbitrary scripts, file/network/database/system administration tasks, and automatic downgrade to unrestricted text mode when the safer controller is unavailable. That mismatch is dangerous because operators may authorize it for limited device automation while it actually functions as a general-purpose arbitrary execution agent.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill documentation claims constrained execution through system-controller, but the implementation silently includes unrestricted text mode and mixed-mode raw command execution. That mismatch is dangerous because users, reviewers, and policy layers may grant the skill more trust than its actual behavior deserves, enabling privilege expansion and misuse.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: Mixed mode broadens the skill from a bounded OS-control helper into a general automation/orchestration agent that can choose V1 raw commands for file and system administration tasks. This creates hidden capability expansion and makes policy enforcement harder because natural-language tasks can be transformed into unrestricted host actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill intentionally exposes unrestricted arbitrary shell command execution, which is far beyond what is justified for a system-controller-based helper. In this context, the capability is effectively equivalent to a remote shell and can be abused for full host compromise, destructive actions, or exfiltration.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The code comments assert that the script only acts as a thin executor for system-controller scripts, but the file also contains a general shell executor. This deceptive capability boundary increases the chance of unsafe approval and misuse because operators may treat the skill as narrowly scoped when it is not.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are very broad and include common natural-language requests such as opening apps, screenshots, OCR, typing text, mouse actions, and hardware changes. In an agent-routing environment, broad triggers increase the probability of accidental invocation of a skill that can control the OS and, in some modes, execute arbitrary commands.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill advertises unrestricted command execution and high-risk administrative operations but does not provide a clear, consolidated warning that these actions can modify files, alter system state, access networks, and affect devices. In context, this is more dangerous because the skill is explicitly positioned as a general Windows control surface, so weak risk communication can lead to unsafe use in privileged environments.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The section describing 'any system command' normalizes arbitrary file, script, network, database, and system-management actions without sufficiently warning about their destructive and security implications. Because the skill also presents examples that directly encourage unrestricted command use, users may invoke highly privileged behaviors without understanding the attack surface or blast radius.

Missing User Warnings

High

Confidence: 97% confidence
Finding: In non-interactive text mode, the program executes raw shell commands directly from arguments without any warning or confirmation. That is especially dangerous for agent-driven invocation, where a model or chained tool can trigger destructive commands non-interactively and immediately.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Mixed mode executes V1 steps through raw command execution without any warning, even though those steps are produced from natural-language task splitting. This allows seemingly benign multi-step requests to trigger arbitrary host commands silently, compounding the risk of prompt abuse or misclassification.

Static analysis

No suspicious patterns detected.