Security audit

File Manager 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This file-management skill is not clearly malicious, but it can perform broad file moves, overwrites, and permanent deletions with weaker safeguards than its documentation promises.

Install only if you are comfortable reviewing every planned file operation first. Avoid running it on broad directories such as a home folder, do not use mirror/delete or scheduled examples until you have backups, and treat --execute, --delete, --move, and --no-confirm as high-risk options.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync.py:54
Finding: Overlapping Synchronization Paths Can Delete Source Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_rename.py:83
Finding: Generated Rename Paths Permit Directory Escape and Destination Collisions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/organize.py:84
Finding: Recursive Organization Can Overwrite Same-Named Files and Reprocess Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:126
Finding: Documented Confirmation and Audit Logging Controls Are Not Implemented
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Note

Location: references/best_practices.md:66
Finding: Optional Scheduled Organization Guidance Enables Unattended Risky File Mutation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unused Dependencies Are Installed Without Reproducible Version Pinning
Content: View full analysis
=4.60.0 # Windows color output support colorama>=0.4.4 ``` ### Technical Analysis The supplied scripts do not import `tqdm` or `colorama`, so installing these packages is not necessary for the declared implementations. The lower-bound-only constraints allow package managers to install any future version satisfying the requirement. The package names are legitimate, and no malicious package, typosquatting, dependency confusion, or unsafe package source was identified. The risk is unnecessary supply-chain exposure and non-reproducible installation rather than evidence of an intentionally malicious dependency. ### Attack Path 1. A user follows `SKILL.md` and installs `requirements.txt`. 2. The package manager resolves versions available at installation time, including future releases not reviewed with this Skill. 3. Third-party installation or runtime code is introduced even though the scripts do not use the packages. 4. A compromised or defective future release could affect the installation environment. ### Impact Assessment The dependencies execute with the privileges of the account performing installation. In a typical virtual environment, impact is limited to that environment and files writable by the user. If installation is performed with administrative privileges, the potential scope increases accordingly. No evidence shows that elevated installation is requested or required. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 代码的实际功能较窄，核心且几乎唯一的能力是批量重命名文件。虽然“文件重命名”属于声明描述中的一个子项，因此并非完全不相关，但声明将技能表述为覆盖多种文件管理任务的综合助手，而代码没有实现智能分类、重复文件检测/清理、目录同步或其他文件管理能力。这属于描述范围明显大于实际行为、主用途被夸大的情况。未发现与文件重命名无关的隐藏行为，也未见网络访问、外部资源访问或其他未声明的敏感能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code is narrowly focused on directory synchronization. It calculates file hashes, compares source and target trees, previews copy/update/delete actions, and executes one-way mirror sync when requested. This partially overlaps with the declared description because directory synchronization is explicitly mentioned. However, the broader declared purpose presents the skill as a comprehensive file-management assistant handling bulk operations, intelligent classification, duplicate cleanup, renaming, and sync workflows. None of the classification, duplicate-cleaning, or renaming capabilities appear in this code chunk. Additionally, the code advertises a --bidirectional mode but the actual function only prints that the feature is under development, so true bidirectional synchronization is not implemented. Because the actual behavior is materially narrower than the declared description and one mentioned sync mode is unimplemented, this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
python scripts/sync.py <source> <target> --mirror

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
python scripts/sync.py <source> <target> --mirror

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
python scripts/sync.py <source> <target> --mirror

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
python scripts/sync.py <source> <target> --mirror

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented watch mode can execute arbitrary commands on file changes via an interpolated command string. That creates a command-execution surface far beyond ordinary file management, and if file paths or watched content can influence arguments, it can lead to arbitrary code execution or dangerous chained actions.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/batch_rename.py (reported line 144)May include surrounding context.
python
help='转换为大写') parser.add_argument('--execute', action='store_true', help='执行重命名 (默认仅预览)') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents file-modifying capabilities such as organize, rename, deduplicate, sync, and watch-triggered actions, but does not declare any tool scope or permission boundaries. In an agent ecosystem, missing explicit file-write restrictions increases the risk of unintended or overbroad filesystem access and makes review and enforcement harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation language is broad enough to match many ordinary file-related requests, which can cause the skill to trigger in situations where users did not intend destructive automation. In a high-impact domain like filesystem operations, overbroad routing increases the chance of unsafe invocation and excessive privilege use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes deletion and movement of files without prominent, repeated warnings about permanence, scope, and backup expectations. For a batch file-management skill, understated risk messaging can directly contribute to accidental data loss when users copy examples verbatim.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill claims modification operations default to dry-run, but the examples show direct modifying and destructive commands without an explicit preview or confirmation step. This inconsistency can cause operators or agents to execute irreversible file changes under false safety assumptions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The safety section says deletion should prefer quarantine, yet the deduplication examples normalize direct deletion. In a file-management context this increases the chance of permanent data loss, especially because deduplication mistakes can affect irreplaceable user files at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown provides backup commands using --mirror --execute, which can delete files in the destination to match the source, but it does not warn users about destructive synchronization behavior or the need to test first. In a file-management skill, users are more likely to copy these commands directly, increasing the chance of accidental data loss from routine automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The scheduled organization example runs automatically and includes --execute --move, which can relocate files every hour without any notice about workflow disruption, misclassification, or loss of expected file locations. Because this skill is specifically for automating file operations, such an example can cause unintended user-impact at scale if adopted without safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This backup example again recommends --mirror --execute for daily synchronization without any safety disclosure, despite mirror operations potentially propagating mistakes or deleting files from the backup target. In the context of a file-manager skill, the omission is more dangerous because users may trust the example as a best practice and deploy it unattended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language descriptions, help text, and prompts that force a specific language/locale for all users. The policy only permits such constraints when the skill offers user opt-in or clearly documents a justified region-specific limitation, which is not present here.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 65% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/batch_rename.py (reported line 144)May include surrounding context.
python
help='转换为大写') parser.add_argument('--execute', action='store_true', help='执行重命名 (默认仅预览)') parser.add_argument('--no-confirm', action='store_true', help='跳过确认') args = parser.parse_args()

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language descriptions and user-facing messages entirely in Chinese, including the module docstring and CLI help/output text. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is clearly justified, which is not documented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains user-facing natural-language documentation that assumes a specific language, which can violate language/locale policy when no user opt-in or justification is provided. The same pattern continues in user-facing CLI messages, but the module docstring is sufficient to establish the issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring states '支持单向镜像同步和双向同步', which communicates that both one-way mirror sync and bidirectional sync are implemented. However, the sync_bidirectional function later only prints placeholder messages indicating the feature is not available, so the documentation materially overstates the tool's actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language interface and documentation are entirely in Chinese, beginning with the module docstring and continuing through user-facing output. Under the stated policy, forcing a specific language without opt-in is a locale-policy violation unless the constraint is explicitly justified or alternatives are offered.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The --bidirectional argument help text presents bidirectional sync as an available mode. In practice, selecting that mode only triggers informational messages from sync_bidirectional that the feature is still under development, which contradicts the user-facing documentation embedded in the code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file's descriptive and instructional natural-language content is presented in Chinese throughout, with no indication that users can choose another language or that the locale restriction is intentional for a region-specific skill. This may violate language or locale policy where user-facing skills should not force a specific language without opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with a lower-bound only (tqdm>=4.60.0), which allows any newer release to be installed. This creates supply-chain risk because builds are not reproducible and a future compromised or breaking version could be pulled in without review; in a file-management skill, that dependency may run in environments with broad filesystem access, increasing the blast radius.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
# File Manager Skill Dependencies # 进度条显示 tqdm>=4.60.0 # Windows 彩色输出支持 colorama>=0.4.4

Static analysis

No suspicious patterns detected.