Wangwei Mkdir

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill is confusing and low quality, but the inspected scripts only print fixed text and do not access data, network, or persistent settings.

Install only if you are comfortable with a poorly documented skill that appears to be a placeholder or broken echo demo. It does not show security-dangerous behavior in the inspected files, but the publisher should fix the name, description, examples, and scripts before users rely on it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill presented as simple echo functionality but tied to repeated fixed script execution creates trust confusion and can lead to accidental execution of local commands. Even without clear malicious payloads in this file, deceptive or inaccurate skill descriptions are a meaningful security problem because they undermine review and safe invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A skill presented as simple echo functionality but tied to repeated fixed script execution creates trust confusion and can lead to accidental execution of local commands. Even without clear malicious payloads in this file, deceptive or inaccurate skill descriptions are a meaningful security problem because they undermine review and safe invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill presented as simple echo functionality but tied to repeated fixed script execution creates trust confusion and can lead to accidental execution of local commands. Even without clear malicious payloads in this file, deceptive or inaccurate skill descriptions are a meaningful security problem because they undermine review and safe invocation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes an echo-style skill, while the body documents backup or mkdir-related script usage. This inconsistency makes the skill more dangerous in context because filesystem-changing capabilities are materially riskier than passive text echoing, and users are not being properly warned.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description at L03 and activation-style text at L08 use the vague phrase "echo ni shuo de hua" without defining when the skill should be invoked or what inputs qualify. This lacks trigger constraints, scope, or negative examples, making unintended invocation more likely.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: Internally contradictory documentation prevents reviewers and users from understanding what the skill will do, which is especially risky when shell scripts are involved. Ambiguity around whether the skill echoes text or modifies directories increases the likelihood of misuse and weakens security review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation references shell scripts that likely create directories or otherwise modify the filesystem, but it provides no warning about side effects, destination paths, or safety constraints. In skill context, omitting such warnings can cause unintentional local changes by users who believe the skill is harmless.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The comments label the file as 'echo.sh' and document usage as './echo.sh abc', implying it echoes an argument supplied by the caller. In reality, the script never reads positional parameters and only prints the fixed string 'abc' many times.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest description 'echo ni shuo de hua' suggests the skill should echo user-provided text, but the script ignores input and repeatedly prints the hardcoded string 'abc'. This is a clear semantic mismatch between the claimed purpose and the implemented behavior.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The comments identify the file as "echo.sh" and the usage as "./echo.sh abc," implying a script that accepts an argument and echoes it. In reality, lines L07-L65 ignore input entirely and print the hardcoded string "abc" many times. This is an active contradiction between the documentation and the code's behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes the skill as "echo ni shuo de hua," which implies echoing user-provided input. However, the script does not use any arguments and instead repeatedly prints the fixed string "abc". This is a semantic mismatch between the stated purpose and the implemented behavior.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The comments identify the file as 'echo.sh' and document usage as './echo.sh abc', implying the script echoes a supplied argument. In reality, lines 7 through 65 ignore any argument and always print the literal string 'abc', directly contradicting the documented intent.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest description 'echo ni shuo de hua' suggests an echo-like skill that would repeat user-provided input. The script does not echo input or create directories; it simply prints the hardcoded string 'abc' many times, which is semantically inconsistent with the stated skill purpose.

Static analysis

No suspicious patterns detected.