Security audit

Smart Agent Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed agent-workflow methodology package, but its persistent memory features and setup guidance create privacy, prompt-injection, and unsafe command risks that should be reviewed before installation.

Install only if you want a stateful workflow skill that writes local memory/log files and you are prepared to review or disable the memory integration. Do not allow stored memory to override higher-priority instructions, restrict where memory files can be written, avoid using attacker-controlled user IDs, and replace the documented curl-to-shell, unpinned npx, and unprotected .env setup steps with pinned and verified alternatives.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: docs/OLLAMA_SETUP.md:17
Finding: Remote Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `docs/OLLAMA_SETUP.md:17-19` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash **Linux:** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ``` ### Technical Analysis The installation instructions pipe content retrieved from an external URL directly into a shell. The downloaded script is not pinned to a reviewed version, saved for inspection, checked against a cryptographic hash, or verified using a trusted signature. Although the hostname is consistent with the named Ollama product, the effective code executed by this command is mutable and is not part of the audited project. The behavior therefore makes the security of the installation process depend entirely on the current remote response and the integrity of the remote distribution infrastructure. This execution method is unnecessary for the Skill's workflow-management functionality and exceeds minimum privilege by permitting an unaudited external response to execute with all privileges of the invoking user. ### Attack Path 1. The remote installation script or its hosting infrastructure is compromised, or the distribution account begins serving a malicious response. 2. A user follows the documented Linux installation command. 3. `curl` downloads the current response from the remote endpoint. 4. The response is passed directly to `sh` without inspection or integrity validation. 5. The payload executes with the invoking user's privileges. 6. If the user invokes the instructions from an elevated shell, the payload may obtain system-wide privileges. ### Impact Assessment A malicious remote response could execute arbitrary commands, access files available to the current user, steal credentials, modify shell configuration, install persistence, download further payloads, or alter local development environments. The scope is the invoking user's account and may beco ...[truncated 66 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | sh` instruction. - Direct users to a versioned package from an official package repository or a specific release artifact. - Pin the exact package or release version. - Publish and verify a SHA-256 or stronger digest before installation. - Verify a release signature against a documented, trusted signing key. - Download the artifact to disk first so users can inspect it before execution. - Explicitly state that installation should occur without elevated privileges unless a specific package operation requires them. - For example: ```bash curl -fL -o ollama-package '<versioned-release-URL>' echo '<trusted-sha256> ollama-package' | sha256sum -c - # Verify the publisher signature as an additional control. ``` ]]>

T02 · Agent Memory Poisoning

Error

Location: integrations/memory_manager.py:117
Finding: Untrusted Conversation Content Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `AGENTS.md:185-192`; `integrations/memory_manager.py:117-176` **Vulnerability Type**: Persistent memory poisoning and prompt injection **Risk Level**: High ### Vulnerable Code `AGENTS.md:185-192`: ```markdown ## 六、学习流程 | 用户说 | 立即执行 | |--------|---------| | "不对" / "错了" / "应该是" | 记录到 logs/YYYY/MM/DD.md | | "记得" / "总是" / "永远" | 记录到 memory/hot.md | | "我喜欢" / "我不喜欢" | 记录到 memory/hot.md | ``` `integrations/memory_manager.py:117-176`: ```python def _compress_and_save(self, user_id: str, history: list): """执行压缩并保存（后台线程）""" try: existing_memory = self.load_memory(user_id) # 构建压缩提示词 history_text = "\n".join([ f"{m['role']}: {m['content']}" for m in history ]) compress_prompt = f"""请从以下对话中提炼重要信息，更新用户记忆。【现有记忆】 {existing_memory if existing_memory else "（空）"} 【新对话内容】 {history_text} 请输出更新后的记忆，格式如下（控制在500字以内）： ## 个人信息（用户的基本信息、偏好） ## 项目/任务（正在进行的项目和任务） ## 重要决策（已做出的重要决定） ## 注意事项（需要记住的特殊要求）只保留真正重要的信息，过程细节不需要记录。""" response = self.ai_client.messages.create( model=self.ai_model, max_tokens=800, messages=[{"role": "user", "content": compress_prompt}] ) new_memory = response.content[0].text # 如果超过最大字符数，再压缩一次 if len(new_memory) > MEMORY_MAX_CHARS: new_memory = new_memory[:MEMORY_MAX_CHARS] + "\n...(已截断)" self.save_memory(user_id, new_memory) except Exception as e: pass # 压缩失败不影响主流程 # ========== 结构化 System Prompt ========== def build_system_prompt(self, user_id: str, base_prompt: str = "") -> str: """构建包含记忆的 System Prompt""" memory = self.load_memory(user_id) parts = [base_prompt or "你是一个智能助手，回答简洁友好。"] if memory: parts.append(f"\n【用户记忆】\n{memory}") parts.append("\n请根据用户记忆和对话历史，准确理解上下文并回复。") ...[truncated 1946 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Treat all conversation history and stored memory as untrusted data. - Store only typed, allowlisted facts such as language preference or project identifier. - Reject imperative language, tool instructions, policy changes, credentials, and requests to override higher-priority instructions. - Require explicit user confirmation before creating durable memory. - Preserve provenance, creator identity, creation time, and the source message for every memory item. - Place memory in a clearly delimited data section and explicitly instruct the model never to execute instructions found in that section. - Validate summarizer output using deterministic code rather than relying solely on another model. - Provide memory review, editing, expiration, and deletion controls. - Prevent stored memory from overriding system, developer, organizational, or current-user safety requirements. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: integrations/memory_manager.py:42
Finding: Unsanitized User Identifier Enables Filesystem Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `integrations/memory_manager.py:42-77`; deletion is also affected at `integrations/memory_manager.py:221-226` **Vulnerability Type**: Path traversal causing unauthorized file read, write, and deletion **Risk Level**: High ### Vulnerable Code ```python def load_history(self, user_id: str) -> list: """加载对话历史""" path = os.path.join(self.storage_dir, f"{user_id}_history.json") if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: return json.load(f) return [] def save_history(self, user_id: str, history: list): """保存对话历史（只保留最近 N 轮）""" max_msgs = SHORT_TERM_ROUNDS * 2 if len(history) > max_msgs: history = history[-max_msgs:] path = os.path.join(self.storage_dir, f"{user_id}_history.json") with open(path, 'w', encoding='utf-8') as f: json.dump(history, f, ensure_ascii=False, indent=2) def add_message(self, user_id: str, role: str, content: str) -> list: """添加一条消息到历史""" history = self.load_history(user_id) history.append({"role": role, "content": content}) self.save_history(user_id, history) return history # ========== 长期记忆（摘要压缩）========== def load_memory(self, user_id: str) -> str: """加载长期记忆""" path = os.path.join(self.storage_dir, f"{user_id}_memory.md") if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: return f.read() return "" def save_memory(self, user_id: str, content: str): """保存长期记忆""" path = os.path.join(self.storage_dir, f"{user_id}_memory.md") with open(path, 'w', encoding='utf-8') as f: f.write(content) ``` The same pattern is used for deletion: ```python def clear(self, user_id: str): """清除用户所有记忆""" for suffix in ['_history.json', '_memory.md', '_stats.json']: ...[truncated 1822 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not use raw user identifiers as filenames. - Convert identifiers to a fixed safe representation, such as a SHA-256 digest or a server-generated UUID. - If readable identifiers are required, enforce a strict allowlist such as `^[A-Za-z0-9_-]{1,64}$`. - Resolve both the storage root and candidate path with `pathlib.Path.resolve()`, then verify that the candidate is a descendant of the storage root. - Reject absolute paths, separators, `.` and `..` components, NUL characters, and platform-specific path syntax. - Reject symlink targets or open files using platform controls that prevent symlink following where available. - Create storage files with restrictive permissions. - Add tests covering `../`, absolute paths, encoded separators, Windows drive paths, and symlink attacks. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: integrations/memory_manager.py:117
Finding: Conversation History and Persistent Memory May Be Sent to an Unrestricted External AI Provider<![CDATA[ ## Vulnerability Details **File Location**: `integrations/memory_manager.py:117-151` **Vulnerability Type**: Uncontrolled sensitive-data transmission **Risk Level**: Medium ### Vulnerable Code ```python def _compress_and_save(self, user_id: str, history: list): """执行压缩并保存（后台线程）""" try: existing_memory = self.load_memory(user_id) # 构建压缩提示词 history_text = "\n".join([ f"{m['role']}: {m['content']}" for m in history ]) compress_prompt = f"""请从以下对话中提炼重要信息，更新用户记忆。【现有记忆】 {existing_memory if existing_memory else "（空）"} 【新对话内容】 {history_text} 请输出更新后的记忆，格式如下（控制在500字以内）： ## 个人信息（用户的基本信息、偏好） ## 项目/任务（正在进行的项目和任务） ## 重要决策（已做出的重要决定） ## 注意事项（需要记住的特殊要求）只保留真正重要的信息，过程细节不需要记录。""" response = self.ai_client.messages.create( model=self.ai_model, max_tokens=800, messages=[{"role": "user", "content": compress_prompt}] ) ``` ### Technical Analysis The memory-compression process combines existing long-term memory with retained conversation history and submits the combined content to a caller-provided `ai_client`. There is no provider allowlist, local-only enforcement, consent check, field-level minimization, or sensitive-data redaction before transmission. The workflow contains a policy not to retain credentials, but this implementation does not enforce that policy before calling the client. Users may still include secrets, personal information, source code, or confidential project details in ordinary conversation history. ### Attack Path 1. The host application configures `MemoryManager` with a remote or attacker-controlled AI client. 2. A user exchanges messages containing private or confidential information. 3. After the configured number of rounds, `should_compress()` initiates asynchronous compression. 4. `_compress_and_save()` concatenates the retained history and existing persistent ...[truncated 582 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit opt-in before sending memory or conversation data to a remote provider. - Clearly disclose the destination, data categories, retention implications, and trigger frequency. - Default to local-only summarization where privacy is a declared objective. - Allowlist approved providers and validate the configured endpoint. - Redact credentials, tokens, private keys, personal identifiers, and other sensitive fields before transmission. - Minimize the submitted history rather than transmitting every retained message. - Provide a configuration option to disable compression or external transmission completely. - Apply transport security and verify provider certificates. - Record auditable metadata about when compression occurred and which provider received the data, without logging the sensitive content itself. ]]>

T08 · Insecure Dependencies

Warning

Location: AGENTS.md:116
Finding: Documentation Invokes Unpinned Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `AGENTS.md:116-118`; `docs/OLLAMA_SETUP.md:94` **Vulnerability Type**: Unpinned package retrieval and execution **Risk Level**: Medium ### Vulnerable Code `AGENTS.md:116-118`: ```bash **技能搜索：** 如需外部能力，可搜索现有 skill： ```bash npx skills find <关键词> # 如: npx skills find slack ``` ``` `docs/OLLAMA_SETUP.md:94`: ```bash # 安装 python-dotenv pip install python-dotenv ``` ### Technical Analysis The `npx skills` command may retrieve and execute a package from the configured npm registry when that package is not already installed. No package scope, exact version, integrity value, or trusted source is specified. This gives the current registry resolution control over code that executes on the local machine. The `pip install python-dotenv` command similarly installs whichever release the active Python package index currently resolves, without an exact version or hash. While `python-dotenv` is a recognized package name, unpinned installation weakens reproducibility and exposes users to future package compromise or index substitution. ### Attack Path 1. A dependency account, registry, mirror, or package release is compromised. 2. An Agent or user follows the documented `npx` or `pip` command. 3. The package manager resolves the latest available package from the configured registry. 4. The package is downloaded without comparison to a project-supplied integrity value. 5. In the `npx` case, package code may execute immediately; in the Python case, malicious installation behavior or imported package code may execute within the environment. 6. The malicious component gains the privileges of the invoking user or build process. ### Impact Assessment A compromised dependency may read local files, steal package-manager or repository credentials, modify the project, alter Agent behavior, or download additional payloads. The scope is the invoking account and any credentials or resources available to the package-manager proc ...[truncated 8 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Pin all third-party tools and libraries to exact reviewed versions. - Commit lock files and verify integrity metadata. - For Python, use a requirements file with hashes, for example: ```text python-dotenv==<reviewed-version> --hash=sha256:<trusted-hash> ``` - Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Replace the bare `npx skills` invocation with a pinned, scoped package name and reviewed version. - Prefer `npx --no-install` when the trusted tool is expected to be installed already. - Use trusted registries and lock registry configuration in controlled environments. - Review transitive dependencies and package lifecycle scripts before use. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: docs/OLLAMA_SETUP.md:81
Finding: Telegram Bot Token Is Written to a Plaintext Environment File Without Protection Guidance<![CDATA[ ## Vulnerability Details **File Location**: `docs/OLLAMA_SETUP.md:81-98`; repeated at `docs/OLLAMA_SETUP.md:156-160` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```bash ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram # 创建 .env 文件 cat > .env << 'EOF' TELEGRAM_BOT_TOKEN=你的Bot Token TELEGRAM_ADMIN_CHAT_ID=你的Chat ID AI_ENGINE=ollama OLLAMA_BASE_URL=http://localhost:11434 OLLAMA_MODEL=llama2 EOF # 安装 python-dotenv pip install python-dotenv ``` ``` The guide later repeats the plaintext write: ```bash # 方式 2：或者创建 .env 文件 echo 'TELEGRAM_BOT_TOKEN=your_bot_token' > .env echo 'TELEGRAM_ADMIN_CHAT_ID=your_chat_id' >> .env echo 'AI_ENGINE=ollama' >> .env echo 'OLLAMA_MODEL=llama2' >> .env ``` ### Technical Analysis The guide instructs users to place a live Telegram bot token in a plaintext `.env` file. It does not instruct them to set restrictive permissions, exclude the file from version control, avoid backups, or prefer a secret-management facility. The final permissions depend on the user's `umask`; in some environments, the file may be readable by other local users. Because `.env` is commonly located inside a project directory, it can also be accidentally committed, archived, copied into container images, or exposed by development tooling. ### Attack Path 1. A user replaces the placeholder with a valid Telegram bot token. 2. The shell creates `.env` using the account's default permissions. 3. Another local user, backup process, development tool, container build, or source-control operation accesses the file. 4. The token is copied or disclosed. 5. An unauthorized party uses the token to authenticate as the Telegram bot until the token is revoked. ### Impact Assessment An attacker obtaining the token can impersonate and control the Telegram bot within the permissions granted by Telegram's Bot API. This may permit sending messages, receiving updates, in ...[truncated 134 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Prefer an operating-system keychain, container secret, or dedicated secret manager. - If `.env` must be used, create it with restrictive permissions: ```bash umask 077 install -m 600 /dev/null .env ``` - Add `.env` and related secret-file patterns to `.gitignore`. - Include a non-secret `.env.example` containing placeholders only. - Warn users never to commit, log, share, or include the real `.env` file in container images. - Validate file permissions at application startup and reject overly permissive secret files. - Document immediate token revocation and rotation procedures. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (89)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a general AI-agent work methodology skill covering planning/reporting/safety/context practices. The supplied code does not implement task classification, WBS decomposition, P0/P1 reporting, or safety checks. Instead, it specifically implements conversation memory persistence and summarization infrastructure. While 'Context 管理' is loosely related, the code's primary purpose is memory/history management with filesystem storage and AI-based compression, which is much narrower and materially different from the declared methodology-focused description. Therefore this is a description-behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill provides an AI agent methodology/process framework, which is conceptual and workflow-oriented. The actual code instead performs a concrete operational task: archiving old .md log files on disk. This is a materially different primary purpose and introduces filesystem-manipulation capabilities that are not declared. There is no evident connection between task planning/methodology features and this archival behavior, so this should be flagged as a mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad AI-agent workflow/methodology skill, emphasizing planning, reporting, safety, and context-management guidance. The supplied code instead implements a concrete file-maintenance utility for a specific markdown memory file. Its primary behavior is to inspect hot.md, create backups, and delete lines tagged [deprecated] when the file grows beyond a threshold. That is a materially different purpose from the declared methodology skill and introduces undeclared filesystem/content-modification capabilities tied to a specific resource (memory/hot.md). This is not merely a supporting implementation detail of the described methodology; it is an operational maintenance script with a different function.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a workflow/methodology skill for AI agent task management and safety practices. The supplied code does something materially different: it generates a weekly performance report from local metrics data. This is not an implementation detail of task classification, WBS decomposition, reporting prioritization, safety checking, or context management. The code also accesses local logs and writes report files, capabilities not reflected in the declared purpose. Therefore the description does not accurately represent the code's actual behavior.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a general AI agent working methodology skill covering planning, decomposition, reporting, safety, and context management. The provided code instead implements a repository health-check utility that inspects specific files/directories and a line-count threshold in memory/hot.md. This is a materially different primary purpose and introduces filesystem validation capabilities that are not reflected in the description. While '安全检查' is mentioned in the description, this code's concrete behavior is structural file-system checking for a template, not the broader methodology functions claimed. Therefore the description does not accurately represent the supplied code chunk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是高层次的工作方法论与流程指导能力，而实际代码仅实现了一个具体的指标记录脚本。代码没有体现任务类型判断、WBS 拆分、P0/P1 分级汇报、安全检查或 Context 管理等核心宣称能力。其主要功能是将运行指标写入本地日志文件，这属于未在描述中体现的实际能力，且与宣称的主要目的存在明显偏差。因此应判定为描述与行为不匹配。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level agent workflow/methodology skill, but the actual code implements a concrete filesystem utility for locked file writes. This is a materially different primary purpose: instead of providing task-judgment, WBS, reporting, safety-review, or context-management logic, it performs file output with lock acquisition and retry handling. The file-writing and lock-management capabilities are undeclared and unrelated to the stated methodology function, so this is a clear description-behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose describes a cross-platform AI-agent methodology skill offering workflow guidance features, while the actual code only performs recursive keyword search in a local logs directory. This is not a supporting implementation detail of the declared methodology functions, and it introduces filesystem log access that is not mentioned in the description or permissions.

External Script Fetching

High

Category: Supply Chain
Content: **Linux:** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` **Windows:**
Confidence: 98% confidence
Finding: The guide recommends piping a remotely fetched shell script directly into sh, which executes network content without prior verification, review, checksum validation, or signature checks. If the upstream server, DNS, TLS trust path, or distribution script is compromised, users could execute arbitrary code on their machine immediately.

Chaining Abuse

High

Category: Tool Misuse
Content: **Linux:** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` **Windows:**
Confidence: 97% confidence
Finding: The use of a shell pipeline to pass curl output directly into sh removes an opportunity for users or tooling to inspect the fetched content before execution. This chaining pattern amplifies the risk of remote code execution from a compromised download source and is especially dangerous in setup documentation because users are likely to copy-paste it verbatim.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: python bot.py ``` ### 方式 2：使用 .env 文件 ```bash cd ~/Desktop/smart-agent-template/integrations/telegram
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash # 清理缓存重试 rm -rf ~/.ollama/models ollama pull llama2 ```
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash # 清理缓存重试 rm -rf ~/.ollama/models ollama pull llama2 ```
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The protocol instructs agents to modify files and, after user confirmation, execute git push to a remote GitLab repository. Embedding direct remote write instructions in a workflow skill is dangerous because it enables code and document exfiltration or unauthorized repository changes, especially when the skill otherwise presents itself as methodology/governance rather than a deployment or release tool.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This markdown file contains operational instructions entirely in Chinese, beginning with the title and continuing throughout the document. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented justification is a reportable locale-policy issue.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This is the same underlying issue: the workflow directs use of `npx skills` without version pinning, creating a supply-chain and arbitrary code execution exposure. Because agent skills may be followed automatically, even an informational lookup command can become dangerous if it triggers remote package resolution and execution.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is presented as workflow methodology, but it also instructs the agent to write user-derived information into persistent logs and memory files as part of normal operation. That expands the skill from guidance into stateful data collection, which increases privacy, retention, and unintended disclosure risk beyond what a user may reasonably expect from a methodology skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The instructions direct the agent to collect user corrections, preferences, and standing guidance into persistent files without clear necessity tied to the skill's stated purpose. In practice, this can accumulate sensitive behavioral data or confidential user content, creating avoidable privacy and secondary-use risks if those files are later exposed or reused in unrelated contexts.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: process-standards/core/SECURITY_CHECK.md:55