Security audit

猫棒状态

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow GPON status helper that logs into one disclosed local device admin page to read status information.

Install only if you own or administer the device at 192.168.11.6. Treat the session cookie and any credentials as sensitive, avoid sharing raw command logs or HTML responses, and use this only on a trusted local management network.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs an HTTP POST login to a device administration interface using the root account and an unauthenticated/empty password flow, but provides no warning about handling privileged credentials or the risks of sending them over plain HTTP. This exposes highly sensitive management access to interception on the local network and normalizes unsafe admin access patterns for infrastructure devices.

Static analysis

No suspicious patterns detected.