Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **其他 AI 工具** | 复制 `SKILL.md` 内容作为系统提示词 | 支持自定义指令 |
Security audit
技能编排器
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent multi-skill orchestrator, but its permission-bypass mode and local discovery/memory behavior need careful review before installation.
Install only if you are comfortable with a skill that can coordinate other skills, scan local skill registries, and keep brief orchestration history. Before using it, treat bypassPermissions/direct execution as unsafe for anything involving files, deployments, APIs, payments, personal data, or third-party skills, and require explicit confirmation for those actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **其他 AI 工具** | 复制 `SKILL.md` 内容作为系统提示词 | 支持自定义指令 |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
高风险操作（遇到任一，必须要求用户确认）：
text - 删除文件或目录（rm / del / truncate） - 执行外部命令（git push / npm publish / docker run） - 发起外部网络请求（发送邮件/短信/支付） - 修改系统配置（.env / ~/.config / 注册表）
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 删除文件或目录（rm / del / truncate）
- 执行外部命令（git push / npm publish / docker run）
- 发起外部网络请求（发送邮件/短信/支付）
- 修改系统配置（.env / ~/.config / 注册表）
- 调度来源不明的第三方 Skill
text
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly documents a
bypassPermissionsexecution mode that skips approvals entirely, yet presents it as suitable for 'pure analysis tasks' without any guardrails or explicit prohibition on state-changing subtasks. In an orchestrator skill, prompts and subtask routing are dynamic, so normalizing approval bypass increases the chance that file edits, external actions, or other sensitive operations are executed without user confirmation.- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill explicitly instructs scanning multiple local directories and reading local skill metadata and memory files. Even though it claims minimal reads, this is still filesystem enumeration of user and project paths, which can expose installed capabilities, project structure, and behavioral history that may be sensitive in aggregate.
- Content
md - SKILL_PATH config: - ~/.workbuddy/skills - .workbuddy/skills - ~/.claw/skills - .workbuddy/memory ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The heading and surrounding operating instructions present the skill as Chinese-first, and the document does not state that output language should follow user preference. This can violate language/locale policy where users must be given a choice rather than having a language imposed implicitly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger says to automatically activate whenever a task is 'complex' or involves multiple domains, steps, or kinds of expertise, but it does not define clear boundaries beyond a high-level notion of complexity. This ambiguity could cause unintended invocation for many common requests that are merely somewhat involved.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L151 states that when the user explicitly says '直接执行', the orchestrator uses
bypassPermissionsto '跳过所有确认' ('skip all confirmations'). Later, L276-L309 impose additional gating conditions and a mandatory confirmation checkpoint before execution in bypass mode. This is an active contradiction in the skill's own documentation about whether confirmations are skipped or still required.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The rule that silently skips confirmation when the user says "直接执行" is ambiguous and has no explicit restriction excluding destructive, external, or privacy-impacting actions. In an orchestrator skill, this can be exploited or misapplied to bypass human approval for deployments, API calls, or personal-data handling, undermining the stated human-in-the-loop safety control.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents all operational guidance and examples in Chinese, including headings and descriptive text, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says
bypassPermissionswill skip all approvals, but provides no mandatory warning, escalation path, or consent requirement before use. In a multi-skill orchestrator, that omission is dangerous because the orchestrator can decompose requests into many subtasks, making it easy for risky operations to occur invisibly under a supposedly convenient execution mode.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The title and surrounding instructional content are written in Chinese with no indication that other languages are supported or that the locale is optional. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file’s headings, descriptions, UI examples, and persistence examples are all written in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-language context. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly instructs the orchestrator to persist execution trace details into working memory, including session identifiers, task descriptions, called skills, conflicts, and result summaries, without any notice, consent flow, retention limit, or data minimization guidance. In an orchestration skill, these traces can contain sensitive user requests, intermediate outputs, and cross-skill metadata, creating privacy leakage and unnecessary long-term retention risk.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The trigger rule says Checkpoint-C activates whenever a task involves an external API call, but it does not clarify whether all API calls qualify or only sensitive/data-transmitting ones. This ambiguity can cause inconsistent or unintended invocation behavior because the trigger scope is not clearly bounded.
- Content
Static analysis
No suspicious patterns detected.