星链自迭代智能体

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:50 AM UTC
• Version: 1.0.0

Overview

This skill openly aims to run an autonomous agent, but it asks for unattended command execution, automatic installs, scheduling, and long-term memory without enough user controls.

Install only if you explicitly want a highly autonomous agent and can run it in a constrained environment. Before use, require per-task approval, disable or tightly restrict exec-plus and automatic installs, set clear schedule expiration and revocation controls, and avoid storing secrets or sensitive task history in long-term memory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:20

Finding

Unattended System Command Execution Without Approval or Privilege Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20
Vulnerability Type: Unrestricted, non-interactive system command execution
Risk Level: Critical

Complete Source Segment — English Translation:

markdown

**Unattended silent mode**: No interactive confirmation; all system commands are executed through exec-plus, with traceable logs recorded throughout.

Technical Analysis

The skill explicitly instructs the agent to execute all system commands through exec-plus without interactive confirmation. It does not define a command allowlist, execution sandbox, least-privilege account, protected-path restrictions, or approval requirements for destructive and privileged operations.

Traceable logging does not prevent unauthorized execution. Because commands can run silently and the skill also delegates work to discovered skills and other agents, untrusted task content or a compromised dependency could reach a broadly capable command-execution interface.

Attack Path

1. An attacker supplies a task, external-agent response, or discovered skill containing instructions that require system commands.
2. The autonomous workflow accepts those instructions as part of task execution or recovery.
3. The skill passes the resulting commands to exec-plus.
4. The commands execute without interactive user confirmation.
5. Depending on the privileges of the agent process, the commands read or modify files, install software, change configuration, create persistence, or invoke network-accessible tools.

Impact Assessment

Successful exploitation can provide the attacker with the effective privileges of the agent or exec-plus process. The affected scope may include project files, user-owned files, credentials accessible to the process, installed software, scheduled tasks, system configuration, and reachable services.

If the process runs with elevated privileges, the impact may extend to system-wide modificatio ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unrestricted silent execution with explicit approval for every mutating, privileged, destructive, or network-capable command.
• Enforce a narrow command and argument allowlist tied to the active task.
• Execute commands in an isolated container or sandbox using a dedicated, unprivileged account.
• Deny access to credentials, home directories, host sockets, protected paths, and unrelated project data by default.
• Add policy checks that reject shell metacharacters, command chaining, privilege escalation, persistence creation, and credential-access operations.
• Display the exact command, working directory, environment changes, and expected effects before approval.
• Apply execution timeouts, resource limits, filesystem restrictions, and network egress controls.
• Preserve tamper-resistant audit logs, but do not treat logging as a substitute for authorization.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11

Finding

Automatic Installation of Unverified Skills Through a Command Execution Tool

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11, 35, 53, 60
Vulnerability Type: Unverified dependency discovery and automatic installation
Risk Level: High

Complete Relevant Source Segments — English Translation:

markdown

2. **Autonomous skill matching** — Invoke skill-auto-discovery to find skills; when one is missing, automatically install it through exec-plus.

Skill matching → Automatically install missing skills

| Missing skill | Automatic discovery + installation through exec-plus |

4. When a missing skill is detected → Automatically discover and install it

Technical Analysis

The skill automatically discovers and installs missing components through exec-plus. No trusted registry, publisher verification, package allowlist, signature validation, integrity hash, immutable version pin, provenance requirement, or review gate is specified.

Consequently, the effective code executed by the agent can change after the audited skill is loaded. Dependency confusion, typosquatting, registry compromise, malicious updates, or manipulated discovery results could cause an attacker-controlled package to be selected and installed. Coupling installation with a broad command-execution tool increases the likelihood that package installation hooks or skill initialization logic will execute immediately.

Attack Path

1. A task requests a capability that is not currently installed.
2. The skill invokes skill-auto-discovery to identify a matching component.
3. An attacker publishes a similarly named or higher-priority malicious component, compromises the discovery source, or manipulates discovery output.
4. The skill selects the malicious component without user review or cryptographic verification.
5. exec-plus installs the component automatically.
6. Installation hooks or subsequent skill invocation execute attacker-controlled code with the agent process's permissions.

Impact Assessment

...[truncated 463 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic installation and require explicit user approval for each new skill or package.
• Permit dependencies only from an organization-controlled registry and a maintained allowlist.
• Pin exact package identities, versions, cryptographic hashes, and trusted publisher signatures.
• Verify provenance and signatures before installation and again before execution.
• Reject ambiguous names, untrusted namespaces, unsigned packages, mutable version tags, and packages with unexpected installation hooks.
• Download and inspect dependencies in an isolated staging environment before promotion.
• Run static analysis, malware scanning, and behavioral sandbox testing on discovered skills.
• Install dependencies with an unprivileged account and prevent installation scripts from accessing credentials or the host filesystem.
• Record the selected source, resolved version, hash, publisher, requested permissions, and approval decision in the audit log.

T06 · System Persistence

Error

• Location: SKILL.md:58

Finding

Recurring Cross-Session Execution Without Consent, Expiration, or Cleanup Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58-59
Additional References: SKILL.md:3, 14, 41 and the cron-trigger tool declaration at SKILL.md:25
Vulnerability Type: Persistent scheduled agent activity
Risk Level: High

Complete Source Segment — English Translation:

markdown

## Trigger Timing

1. Upon receiving a long-running or complex task → Execute the entire process autonomously
2. Every day at 03:00 → Review the previous day's tasks and optimize capabilities
3. Every hour → Track progress and troubleshoot anomalies in active tasks
4. Upon detecting a missing skill → Automatically discover and install it
5. Upon receiving a cross-robot collaboration task → Coordinate multiple agents

Technical Analysis

The skill defines recurring hourly and daily behavior and declares a cron-oriented trigger tool. These activities can survive the initiating interaction and continue executing autonomous troubleshooting, optimization, or installation logic.

The instructions do not require informed user consent before schedule creation. They also omit schedule ownership, expiration, maximum runtime, visible status, revocation procedures, task-completion cleanup, and restrictions on what recurring jobs may execute. This creates a persistence mechanism that can repeatedly invoke other high-risk capabilities after the original session ends.

Attack Path

1. A long-running task activates the autonomous workflow.
2. The workflow registers or uses hourly and daily triggers through the scheduling capability.
3. The initiating conversation ends, but the recurring triggers remain active.
4. A trigger launches progress tracking, troubleshooting, workflow optimization, or dependency installation.
5. Compromised state, malicious task content, or poisoned dependencies cause the recurring workflow to execute harmful operations repeatedly.
6. In the absence of automatic cleanup or a clear revocati ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

• Make every recurring schedule explicitly opt-in and show its frequency, purpose, commands, owner, and expiration before creation.
• Require separate authorization for host-level scheduler changes.
• Use task-scoped schedules with short expiration times and strict maximum execution counts.
• Automatically delete all schedules when the associated task completes, fails, expires, or is canceled.
• Provide a visible schedule inventory and a one-step revocation mechanism.
• Restrict scheduled jobs to a narrow allowlist; prohibit package installation, privilege changes, and arbitrary command execution.
• Run scheduled activity in a sandbox under a dedicated unprivileged identity.
• Use unique identifiers and tamper-resistant logs for schedule creation, modification, execution, and deletion.
• Alert the user before extending a schedule or changing its permitted actions.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:14

Finding

Unvalidated Cross-Session Memory Writes and Autonomous Policy Optimization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-16
Vulnerability Type: Persistent storage of potentially attacker-controlled experience and preferences
Risk Level: High

Complete Source Segment — English Translation:

markdown

5. **Autonomous iterative optimization** — Perform an automatic review every day at 03:00 and autonomously optimize workflows and parameter configuration.
6. **Cross-agent collaboration** — Connect to other robots and collaborate on complex tasks.
7. **Long-term memory** — Enable long-term-memory to record user preferences and execution experience across sessions.

Technical Analysis

The skill persists user preferences and execution experience across sessions while also autonomously changing workflows and parameter configuration. It does not specify a trusted schema, provenance validation, separation between data and instructions, per-user isolation, retention limit, sensitive-data filtering, or user review.

Task content, external-agent responses, dependency output, and error-recovery observations may therefore be interpreted as durable experience. An attacker can attempt to insert instructions or false preferences into these sources so that later sessions consume them as trusted state. Autonomous workflow optimization increases the risk because poisoned records may be converted into persistent behavioral or configuration changes.

Attack Path

1. An attacker places a malicious rule, false preference, or misleading operational lesson in task content, dependency output, or a cross-agent response.
2. The workflow treats the content as execution experience or a user preference.
3. The content is written to long-term-memory without provenance validation or explicit user approval.
4. A later session retrieves the persistent record.
5. The agent applies the poisoned record during planning, skill selection, command execution, or workflow optimization.
6. The malicious b ...[truncated 701 chars]

Remediation

View remediation

Remediation Suggestions

• Store only explicitly defined, structured preference fields; never persist free-form instructions as trusted memory.
• Require explicit user approval before creating or changing cross-session preferences.
• Attach source provenance, author identity, timestamps, task identifiers, and trust levels to every record.
• Separate untrusted observations from executable rules and prevent retrieved memory from overriding system or safety policies.
• Validate and sanitize content from external agents, discovered skills, command output, and task documents before storage.
• Isolate memory by user, project, and task; enforce authorization checks for every read and write.
• Detect and block credentials, tokens, personal information, and other secrets from long-term storage.
• Define retention periods and provide user-visible review, correction, export, and deletion controls.
• Require approval and regression testing before converting historical experience into workflow or parameter changes.
• Maintain immutable version history and support rollback of all automatically optimized configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger scope is extremely broad: long-cycle tasks, daily reviews, hourly tracking, automatic installation on skill gaps, and cross-agent coordination. In an autonomous agent with execution, memory, scheduling, and installation capabilities, vague activation conditions can cause unintended invocation and privilege-bearing actions without clear operator intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly permits all system commands through exec-plus in an unattended, non-interactive mode, while elsewhere allowing automatic skill installation. Combining shell execution with autonomous installation and retries creates a high-risk remote-action surface that could modify the host, install untrusted components, or execute destructive commands without a prominent safety warning or approval barrier.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

All user-facing natural-language instructions and descriptions are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill enables long-term memory across sessions to store user preferences and execution history, but it does not describe consent, retention limits, or data sensitivity handling. In a cross-session autonomous agent, this can lead to privacy leakage, excessive retention, or reuse of sensitive operational context beyond user expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states both that execution is 'unattended silent mode' with no interactive confirmation and that the workflow starts after syncing user confirmation. This ambiguity is dangerous because downstream agents may choose the less restrictive interpretation and execute shell-capable actions without a clear approval gate, especially in a self-scheduling autonomous agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented background triggers run on a timer and on environmental conditions like 'skill missing' or 'cross-robot task received' without defining authorization checks, rate limits, or stop conditions. This creates a pathway for uncontrolled repeated activation, cascading actions, and accidental persistence in a 24x7 unattended agent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.