Local ContextBridge 中文

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:04 AM UTC
• Version: 1.0.2

Overview

This skill is a local document search bridge, but it gives an agent persistent access to private or internal files with too little visible scoping or warning.

Review before installing. Use a dedicated virtual environment, pin or verify the cbridge-agent version, and add only narrow folders you explicitly want searchable. Do not watch home directories, shared drives, secrets, legal, medical, financial, customer, or regulated data unless you are comfortable with snippets and file paths being available to the agent. Require the agent to tell you when it searches local documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 51
Vulnerability Type: Unpinned package installation from the default Python package registry
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install cbridge-agent

Technical Analysis

The installation instruction retrieves and installs cbridge-agent from pip's configured package registry without specifying a reviewed version or validating an integrity hash. Consequently, the code installed when this instruction is followed may change after the Skill has been audited.

Python package installation can execute attacker-controlled build or installation logic. If the package publisher account, distribution infrastructure, or a future release is compromised, following this instruction could execute malicious code with the privileges of the user running pip. The referenced source repository does not independently establish that the registry artifact is identical to reviewed source.

This risk is heightened because the installed application is intended to monitor and index local directories containing personal or internal Word, Excel, PDF, and Markdown documents.

Attack Path

1. An attacker compromises the package publisher account, release pipeline, or package distribution channel.
2. The attacker publishes a malicious version of cbridge-agent.
3. A user or agent follows the Skill instruction and runs pip install cbridge-agent.
4. Pip retrieves the current compromised release because no version or artifact hash is enforced.
5. Malicious build, installation, or runtime code executes under the installing user's account.
6. The compromised application can access files available to that account, including document directories subsequently registered through cbridge watch add.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user who performs the installation. This ...[truncated 322 chars]

Remediation

View remediation

Remediation Suggestions

• Pin cbridge-agent to a specifically reviewed version rather than installing the latest available release.
• Distribute a lock file or requirements file containing cryptographic hashes, and install it with pip's --require-hashes option.
• Verify that the published package artifact corresponds to the reviewed source repository and document the package's provenance.
• Install the dependency inside a dedicated virtual environment or another appropriately isolated environment.
• Require explicit user approval before installation and before adding directories containing sensitive documents.
• Apply least privilege by granting the indexing process access only to directories required for the user's request.
• Establish a controlled update process in which new releases are reviewed and their hashes updated before deployment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is overly broad: it instructs use whenever the user asks about local files, private data, or internal knowledge, without requiring explicit confirmation or narrow eligibility checks. In an agent setting, this can cause unintended invocation against sensitive local content and expose private snippets or file paths when normal conversation ambiguously matches the trigger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description advertises searching personal and internal documents and returning highly relevant text snippets and file paths, but it does not warn about privacy, metadata exposure, or the sensitivity of indexed local content. In this context, omission of these warnings is dangerous because users may not understand that the tool can surface confidential excerpts and filesystem locations to the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The installation and watch-folder setup tells users to add document directories for ongoing monitoring/indexing but does not adequately warn that this creates persistent visibility into local files and future changes. Because the skill is specifically designed to bridge private/internal documents into agent responses, the lack of warning materially increases the chance of accidental overexposure of sensitive information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to use the tool '尽量做到无感使用' encourages silent or opaque activation, reducing the user's awareness that local documents are being searched. Combined with retrieval of document snippets and paths, this creates a real risk of unauthorized or surprising access to sensitive data in response to loosely related prompts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.