感觉检索 · 美术风格对照表

• Outcome: Review
• Latest audit: Oct 29, 2026 · 10:54 PM UTC
• Version: 1.2.0

Overview

With cloud access enabled, this skill can send your description despite finding a local style match, contradicting its stated fallback rule.

For private descriptions, omit --allow-cloud or use --offline after caching the dictionary. Clearing FS_QUOTA does not stop saved-token reuse; remove the saved token if needed. Pin and review the optional MCP package before running it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tainted flow: 'req' from os.environ.get (line 156, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fs_api.py (reported line 161)May include surrounding context.

python

req.add_header(k, v)
    req.add_header("User-Agent", "feeling-search-skill/1.0")
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            raw = resp.read()
            return json.loads(raw.decode("utf-8", "replace"))
    except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 180, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fs_api.py (reported line 186)May include surrounding context.

python

for k, v in (headers or {}).items():
        req.add_header(k, v)
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            raw = resp.read()
            return json.loads(raw.decode("utf-8", "replace"))
    except urllib.error.HTTPError as e:

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding is partially valid: a successful direct style-name match can still trigger cloud fallback because the fallback test considers only matched words, violating the stated local-first boundary. With --allow-cloud and a configured token, this can unnecessarily transmit a potentially confidential art brief and consume quota; separately documented paid style/image commands are not inherently unauthorized merely because they lack the analyze-specific flag.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y feeling-search-mcp'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The documented command uses npx -y with @latest, automatically downloading and executing a mutable package release without an installation confirmation. A compromised publisher or malicious future release could execute code with the agent's filesystem, environment, and network privileges; the art-search purpose does not require this supply-chain exposure.

Content

No source excerpt is available for this finding.

Tainted flow: 'tmp' from os.environ.get (line 118, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fs_api.py (reported line 122)May include surrounding context.

python

payload = {"token": token, "saved_at": int(time.time())}
    if meta:
        payload.update(meta)
    with open(tmp, "w", encoding="utf-8") as fh:
        json.dump(payload, fh, ensure_ascii=False)
    os.replace(tmp, quota_path())
    return quota_path()

The documented guarantee that an empty FS_QUOTA prevents paid calls is contradicted by token fallback.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

L032 explicitly states that leaving FS_QUOTA empty means paid endpoints will never be called. In contrast, resolve_quota accepts --quota or silently falls back to a saved token, which the paid request handlers then use. Clearing the environment variable therefore does not disable paid access as documented.

Content

No source excerpt is available for this finding.

Tainted flow: 'tmp' from os.environ.get (line 226, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fs_api.py (reported line 227)May include surrounding context.

python

try:
        os.makedirs(cache_dir(), exist_ok=True)
        tmp = path + ".tmp"
        with open(tmp, "w", encoding="utf-8") as fh:
            json.dump(data, fh, ensure_ascii=False)
        os.replace(tmp, path)
    except OSError:

Paid style and image requests bypass the manifest's local-miss and cloud-consent conditions.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The manifest promises paid cloud calls only when nothing matches locally and the user allows them. However, cmd_style and cmd_images directly request endpoints documented as billable at L019–L020, automatically attaching any resolved quota token without checking local results or requiring --allow-cloud. Retrieving the reference images promised by the manifest can therefore consume quota outside its stated fallback conditions.

Content

No source excerpt is available for this finding.