Security audit

Find Orphans

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed code-cleanup skill that analyzes project files and may generate a deletion script only after user confirmation.

Install only if you want a project cleanup assistant. Review every proposed orphan file manually, treat results as heuristic, generate deletion scripts only after explicit confirmation, and run the build/tests before committing removals.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The skill includes a ready-to-run shell script with git rm commands that delete repository files. Even though presented as an example after confirmation, embedding concrete destructive commands in the skill increases the risk that an agent generates and executes file deletions based on imperfect static analysis, leading to code loss or workflow disruption.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
md
# 回滚：git checkout backup-before-cleanup set -e git rm src/components/OldModal.tsx git rm src/utils/legacy.ts git rm src/pages/TestPage.tsx git rm src/styles/old-theme.scss

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: This line is part of a destructive cleanup script that removes a utility file via git rm. In this skill's context, orphan detection is heuristic and explicitly acknowledges false-positive scenarios such as dynamic imports and feature flags, so providing direct deletion commands is unsafe because valid code may be removed.
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
md
set -e git rm src/components/OldModal.tsx git rm src/utils/legacy.ts git rm src/pages/TestPage.tsx git rm src/styles/old-theme.scss

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The script line deletes a page component, which is particularly risky because routing may be dynamic, convention-based, or environment-controlled. The skill itself notes these false-positive cases, so a generated git rm command can break application navigation or remove latent but valid functionality.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
git rm src/components/OldModal.tsx git rm src/utils/legacy.ts git rm src/pages/TestPage.tsx git rm src/styles/old-theme.scss echo "清理完成，请运行 npm run build 验证"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: The script directly removes a style file, but stylesheet usage may occur through non-obvious paths such as HTML links, build pipelines, theme loaders, or runtime imports. Including direct git rm commands encourages unsafe automation from incomplete dependency analysis and can cause visual regressions or broken builds.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
git rm src/components/OldModal.tsx git rm src/utils/legacy.ts git rm src/pages/TestPage.tsx git rm src/styles/old-theme.scss

echo "清理完成，请运行 npm run build 验证"

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation guidance is broad enough to trigger on generic cleanup requests such as removing unused files or legacy code, which can cause the skill to run in situations where deletion-oriented recommendations are risky or not specifically requested. In a code-cleanup skill, over-broad activation increases the chance of inappropriate analysis or cleanup suggestions being applied to important but indirectly referenced files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill text instructs outputting a report titled in Chinese and is written to activate on Chinese cleanup phrases, which can bias the assistant toward Chinese output even when the user did not request that language. Forced language behavior can reduce user comprehension of deletion recommendations or warnings, increasing the risk of mistakes during code cleanup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata description includes broad triggers like cleanup, find unused, and removing legacy code, which can cause the skill to activate in situations where the user did not explicitly request destructive analysis or deletion planning. Because this skill culminates in generating deletion commands, accidental invocation increases the chance of unsafe file-removal recommendations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation scenarios are ambiguous and non-specific, such as project slimming, refactor prep, and historical cleanup, which are common tasks that may not imply permission to recommend or generate deletion steps. In context, this is more dangerous because the skill later offers a shell script containing git rm commands, so a loosely triggered workflow can escalate from analysis to destructive action too easily.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description is written entirely in Chinese, which indicates a language-specific presentation without any stated user opt-in or explanation that the skill is region-specific. Under the policy, forcing a specific language without choice or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Most of the skill instructions are written in Chinese, while the metadata description also mixes English and Chinese, with no indication that the user can choose their preferred language. If organizational policy requires not forcing a language or locale without opt-in, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.