C盘清理员

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 0.1.0

Overview

This C-drive cleanup skill is not clearly malicious, but it documents destructive cleanup through a missing PowerShell script and includes deletion rules that are too broad for safe automatic use.

Review carefully before installing or running. Use DryRun only until the missing PowerShell script is included and reviewed, remove ExecutionPolicy Bypass or pin execution to a trusted package path, and replace broad name-based cleanup rules with exact approved directories. Do not approve deletion of backup, WPS, or AppData paths unless you have inspected the exact path and contents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:169

Finding

PowerShell Execution Policy Bypass with an Untrusted Relative Script Path

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 169–174; duplicated in README.md, lines 28–40, and meta.json, lines 13–16
Vulnerability Type: Unsafe command execution configuration
Risk Level: Medium

Vulnerable Code

powershell

powershell -ExecutionPolicy Bypass -File ".\script\c-drive-safe-cleanup.ps1"

powershell

powershell -ExecutionPolicy Bypass -File ".\script\c-drive-safe-cleanup.ps1" -DryRun

powershell

powershell -ExecutionPolicy Bypass -File ".\script\c-drive-safe-cleanup.ps1" -LogOutputPath ".\tasks\evaluation-2026-04-22-c-disk-cleanup.md"

The corresponding metadata declares:

json

"scripts": {
  "cleanup": "powershell -ExecutionPolicy Bypass -File .\\script\\c-drive-safe-cleanup.ps1",
  "dry_run": "powershell -ExecutionPolicy Bypass -File .\\script\\c-drive-safe-cleanup.ps1 -DryRun"
}

Technical Analysis

The documented commands launch PowerShell with ExecutionPolicy Bypass, suppressing execution-policy enforcement for that process. They also identify the script through a path relative to the caller's current working directory rather than a verified package root or trusted absolute path.

The referenced script/c-drive-safe-cleanup.ps1 is absent from the audited artifact, even though README.md and meta.json claim that it is included. Consequently, the intended implementation and its safety properties cannot be audited. More importantly, a file placed at the expected relative path could be executed without execution-policy checks if a user runs the command from an attacker-influenced directory.

Execution policy is not a complete security boundary, but explicitly bypassing it removes a defense-in-depth control and increases the consequences of relative-path substitution.

Attack Path

1. An attacker gains the ability to create or modify files in the directory from which the user will run the documented command.
2. The attacke ...[truncated 841 chars]

Remediation

View remediation

Remediation Suggestions

1. Include script/c-drive-safe-cleanup.ps1 in the distributed artifact and subject its complete implementation to security review.
2. Remove -ExecutionPolicy Bypass from all commands unless a documented and narrowly justified requirement exists.
3. Resolve the script path from a trusted installation or repository root rather than the caller's current working directory.
4. Verify the script's cryptographic hash or Authenticode signature before execution.
5. Ensure the package manifest is generated from actual packaged files so nonexistent implementations cannot be advertised.
6. Keep the DryRun path subject to the same integrity controls as the destructive execution path.
7. Update skill.md, README.md, and meta.json together so that all invocation examples use the hardened command.

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:48

Finding

Ambiguous Name-Based Whitelist Can Extend Destructive Cleanup Beyond Intended Cache Paths

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 48–54
Vulnerability Type: Insufficient path validation for recursive deletion
Risk Level: High

Vulnerable Code

text

12. `%APPDATA%`, `%LOCALAPPDATA%` 下已卸载应用遗留缓存目录（仅限明确匹配 `cache/tmp/log` 命名且可识别为非系统应用）
13. WPS 缓存/暂存目录（仅在检测到已安装 WPS 时启用）：
   - `%APPDATA%\kingsoft\office6\temp`
   - `%LOCALAPPDATA%\Kingsoft\WPS Office\*cache*`
   - `%LOCALAPPDATA%\Kingsoft\WPS Office\addons\pool\win-i386`
   - 其他位于 `C:` 且可明确识别为 WPS 临时/缓存语义的目录（名称包含 `temp/cache/backup`，且不在系统核心目录内）

Technical Analysis

These entries expand the stated whitelist from fixed paths into broad, semantic matching rules. A directory can qualify merely because its name contains cache, tmp, log, or backup, or because it is subjectively identified as residue from an uninstalled application. In particular, allowing other matching WPS directories anywhere on C: is inconsistent with a strict path whitelist.

Names such as backup do not prove that content is disposable. They may identify unique recovery data or user documents. Wildcard matching such as *cache* can also select directories that were not explicitly reviewed.

The deletion rules require recursive removal of approved directory contents, but the project does not require canonical path resolution, rejection of symbolic links, junctions, or other reparse points, or verification that every traversed descendant remains under an approved root. A directory that appears to be within an approved location could therefore redirect traversal to another location.

Because the executable PowerShell implementation is missing, it is not possible to establish whether the absent implementation would mitigate these risks. The written requirements themselves do not mandate the necessary safeguards.

Attack Path

A name-misclassification attack can proceed as follows:

1. A legitimate or attacker-created directory under an inspected l ...[truncated 1454 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace semantic and substring-based matching with a finite list of exact, documented cleanup roots.
2. Remove generic backup directories from disposable targets; treat backup content as user data unless an application-specific specification proves otherwise.
3. Resolve environment variables and canonicalize every path before scanning and again immediately before deletion.
4. Verify that each canonical target is a strict descendant of an exact approved root.
5. Detect and reject symbolic links, junctions, mount points, and other filesystem reparse points during both traversal and deletion.
6. Do not recurse into descendants whose canonical paths leave the approved root.
7. Bind confirmation to an immutable target identity and revalidate it immediately before deletion to reduce time-of-check/time-of-use substitution.
8. Present the canonical path and a clear content classification to the user before approval.
9. Add automated tests covering wildcard overmatching, junction traversal, symbolic links, path normalization, case variations, and maliciously named directories.
10. Implement safe failure behavior: if a path cannot be conclusively validated, skip it and record the reason without deleting any content.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest sets the skill language to "zh-CN", and the title/description also indicate Chinese-only interaction. Under the policy rule, forcing a specific language is a concern unless the skill offers a language choice or clearly documents a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L006 明确要求“逐项用中文解释用途与清理影响”，文件其余部分也多次将中文说明作为强制要求，而未说明这是用户可选项或仅在中文环境下适用。对于适用于所有文件类型的自然语言策略检查，这构成了强制特定语言输出而缺少用户选择或明确限定场景的问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The WPS whitelist includes a catch-all rule for any C: path with names containing temp/cache/backup if it is 'clearly identifiable' as WPS-related, which is subjective and easy to over-expand in implementation. In a destructive cleanup skill, this ambiguity can cause deletion outside the intended safe set, including user data or application state that merely matches naming heuristics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L160 将“每个目录都给出中文解释”列为执行检查项，说明语言限制不仅是示例性表述，而是执行上的硬性要求。文件中未见允许用户选择其他语言或基于地区合规进行限定的说明，因此仍属于自然语言层面的 locale/语言政策风险。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.