Security audit

冒烟测试

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent web-app QA workflow, but it includes broad activation triggers plus production edits, service restarts, destructive tests, and state restoration steps without clear consent or environment safeguards.

Install only if you intend to use it for authorized web-application QA and can keep it away from live production data by default. Before using it, require explicit user approval for destructive tests, source edits, uploads, service restarts, DB restore steps, financial/trading-like actions, and any long-term memory updates.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The V9 scheme documents SSH-based service stop/copy/restore operations against production-like state, which exceeds passive web UI verification and introduces infrastructure-level destructive capability. In the context of an agent skill, normalizing direct DB file manipulation and service interruption can lead to accidental misuse against live environments, data loss, or unauthorized state tampering if the workflow is invoked without strict environment gating.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger phrases are overly broad and include common terms like "test" and "audit", which can cause the skill to activate during ordinary conversation or when another more appropriate skill was intended. In this skill's context, accidental activation is risky because the documented workflow includes invasive QA, code modification, restart, upload, and reporting actions, so a simple ambiguous phrase could escalate into high-impact behavior.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The README explicitly describes high-impact actions including code repair, source edits, uploads, service restarts, and persistence to long-term memory, but does not pair them with strong user warnings, approval requirements, or environment safety boundaries. In a skill intended to auto-load from trigger phrases, this omission can lead to unsafe execution against production-like systems or unintended data/code changes without informed consent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases are overly broad and include common requests like 'test', 'audit', and 'fix bugs', which increases the chance the skill is invoked in contexts the user did not intend. Because this skill includes guidance for destructive testing, production changes, and service restarts, accidental activation broadens the attack surface and can lead to unsafe operations being proposed or performed in the wrong environment.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This section explicitly instructs destructive testing against real backends, including create/delete/submit actions and direct state manipulation, but does not require a non-production environment or prominent user consent gating. In the context of a generally triggered QA skill, that is dangerous because it can cause real data loss, integrity issues, or service disruption if applied to a live system.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs editing source files, uploading them to production, and restarting services, again without mandatory approval, change-control checks, or environment restrictions. In practice this gives an agentic workflow a path to alter live application behavior and availability, which could be abused or accidentally triggered to deploy faulty or malicious changes, causing outage, compromise, or loss of integrity.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The English example triggers are very broad and map to common, ambiguous QA requests such as 'test', 'regression test', and 'functional test'. In an agent ecosystem, this can cause the skill to activate in situations beyond the user's intended scope, potentially granting a workflow permission to inspect, modify, and iteratively fix a web application when a narrower or read-only capability would have been more appropriate.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description advertises a broad 'test–fix' workflow without defining clear boundaries for when the skill should only test versus when it may analyze root cause and change code. That ambiguity increases the risk of overbroad invocation and unintended escalation from observation into modification, especially because the skill is framed as an iterative end-to-end workflow.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented backup/restore flow stops services and overwrites database and config files but does not prominently warn about downtime, rollback, or irreversible overwrite risks. In an agent-assisted workflow, omission of those safeguards makes it more likely an operator or automation will execute the steps on the wrong host or at the wrong time, causing service outage or corruption of legitimate state.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: V11 explicitly covers buy, sell, cancel, and liquidate actions and instructs executing them via the UI, but it does not require a sandbox/test account or warn that these actions modify real backend state. In this skill context, that is especially dangerous because the workflow is designed for automated QA and could be applied broadly to a live trading-like webapp, causing unintended transactions and financial impact.

Static analysis

No suspicious patterns detected.