Skill Section Fixer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 2.0.0

Overview

This skill is a SKILL.md repair utility, but it can rewrite many installed skill files in place and has under-scoped batch behavior that users should review before installing.

Install only if you intentionally want a Chinese-language maintenance tool that rewrites SKILL.md files. Use dry-run first, pass an exact path, review the generated frontmatter and sections, and avoid broad batch mode unless you have backups or version control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code substantially matches part of the declared purpose: it does repair missing SKILL.md sections for 功能描述 and 使用示例. However, two declared capabilities are absent. First, although the code can parse frontmatter boundaries, it never inspects, adds, or repairs the claimed frontmatter fields (version/author/changelog/metadata). Second, the description says it supports batch repair of an entire skills directory, but the CLI accepts a single skill path and processes only one SKILL.md at a time. These are material omissions from the declared functionality, so the description does not accurately represent the actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 整体上，该代码的主要目的与声明较为接近，确实是在修复技能文档中的缺失章节和 frontmatter，并支持批量处理。但描述并不完全准确。首先，实际代码补全的 frontmatter 不仅包括声明中的 version/author/changelog/metadata，还会额外创建或补全 name 和 description，这属于未声明的写入能力。其次，主程序在 `if batch_mode or target_path.is_dir()` 条件下，只要目标是目录就会执行批量遍历，因此实际触发行为比“支持批量修复”描述得更宽。最后，`scan_skills` 用于判定 frontmatter 完整性的检查只验证了 name/version/author/description，没有把声明中特别提到的 changelog 和 metadata 纳入“已完整”判断，说明实现与描述在检查标准上存在偏差。虽然这些问题不改变其大方向用途，但已构成描述与行为不完全一致。

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module documentation states that the tool adds missing frontmatter fields, but no such behavior exists in code. Security-relevant tooling that overstates what it repairs can cause users and automated pipelines to rely on protections that are absent, resulting in silent policy bypass or incomplete remediation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises that it repairs required frontmatter fields, but the implementation only inserts missing markdown sections and never validates or adds version, author, changelog, or metadata fields. This creates a dangerous integrity gap: downstream systems or users may trust the tool to enforce required metadata, leading to malformed or noncompliant skills being accepted or published without expected controls.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and instructs file-reading and file-writing behavior across skill directories, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, undeclared filesystem capabilities reduce transparency and policy enforcement, making it easier for the skill to modify local files without explicit review.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example activation phrase is broad enough that ordinary user requests like '批量修复所有技能' could trigger directory-wide file modifications without sufficient confirmation or narrowing. In a skill that performs writes, overly generic invocation examples increase the chance of accidental mass edits.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The quick-start trigger phrases are underspecified and lack guardrails, so common requests such as '修复单个技能' or '批量修复全部技能' may activate write behavior without validating intent, target path, or safe scope. In the context of a filesystem-modifying skill, this raises the risk of unintended or overbroad changes.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The module docstring describes the tool entirely in Chinese, and the user-facing CLI messages elsewhere in the file follow the same pattern. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The metadata claims support for batch repair of an entire skill directory, but the code only processes a single provided skill path and never iterates over a directory tree. This can mislead operators into believing broad remediation occurred when only one skill was checked, leaving other files unfixed and creating coverage blind spots.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module description, CLI output, and generated SKILL.md section text are all fixed in Chinese, which imposes a specific language on users. The file does not provide user opt-in, localization support, or a documented justification that this tool is intended only for a Chinese-language environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script can bulk-modify many SKILL.md files in place with no confirmation gate beyond command-line flags, so a mistaken target path or invocation can silently rewrite large portions of a skills repository. In this skill context, that is more dangerous because the tool is explicitly designed for batch operation on documentation assets, amplifying accidental integrity damage at scale.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The batch scan determines whether a skill is already compliant using only name/version/author/description, while the tool’s stated required fields also include changelog and metadata. This inconsistency can cause non-compliant files to be misclassified as already OK and skipped, undermining repository policy enforcement and leaving malformed metadata in place.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The manifest describes a fixer for missing required sections and frontmatter fields, which implies structural completion. In practice, the code auto-generates substantive placeholder prose for '功能描述' and '使用示例', adding generic capability claims such as automation, integration, and advanced scenarios that may not reflect the actual skill.

Static analysis

No suspicious patterns detected.