Security audit

Find Everything

Security checks for vulnerabilities and agentic risk

Overview

This skill is a search helper, but it needs Review because it can run shell commands from search terms, execute unpinned package tools, install third-party resources, and persistently modify its registry.

Install only if you are comfortable with a search skill that can run local shell commands and install or configure third-party tools. Use it in a sandboxed environment, avoid passing untrusted search text, require explicit confirmation before installs or registry edits, and prefer pinned package versions and reviewed source artifacts before allowing it to modify your setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:31
Finding: Shell Command Injection Through Unquoted User-Controlled Search Query
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: [--check-name <name> --known-skills references/known_skills.txt]` **3.** 读取 `references/security-checklist.md`，结合 security_scan.py 结果做 LLM 上下文评估 **4.** 输出量化评分（0-100）和风险定级 **5.** [SAFE] → 执行安装；[CAUTION] → 展示详情让用户确认；[RISK] → 明确提示风险，不自动安装 ``` Relevant registry entries also recommend unpinned `npx` package execution: ```json "command": "npx skills find {query}" ``` ```json "install_hint": "claude mcp add prompts-chat -- npx -y @fkadev/prompts.chat-mcp" ``` ### Technical Analysis The search workflow execute ...[truncated 2606 chars]:128
Finding: Unpinned Third-Party Package Execution and Installation Before Security Review
Content: View full analysis
` 安装到临时目录后读取 | ``` ```markdown **2.** 运行安全扫描（路径相对于本 SKILL.md 所在目录解析）：`python3 scripts/security_scan.py [--check-name --known-skills references/known_skills.txt]` **3.** 读取 `references/security-checklist.md`，结合 security_scan.py 结果做 LLM 上下文评估 **4.** 输出量化评分（0-100）和风险定级 **5.** [SAFE] → 执行安装；[CAUTION] → 展示详情让用户确认；[RISK] → 明确提示风险，不自动安装 ``` Relevant registry entries also recommend unpinned `npx` package execution: ```json "command": "npx skills find {query}" ``` ```json "install_hint": "claude mcp add prompts-chat -- npx -y @fkadev/prompts.chat-mcp" ``` ### Technical Analysis The search workflow executes `npx skills` without a pinned package version or integrity value. If the package is absent locally, `npx` may retrieve and run a package selected through the package registry. The reviewed configuration provides no lockfile, checksum, package allowlist, or version constraint for this execution. The fallback review workflow also uses `npx skills add ` to place an untrusted Skill in a temporary directory before reading and scanning it. This reverses the intended security boundary: acquisition through an installation command occurs before the deterministic scan and LLM assessment. The documentation does not guarantee that installation is inert, disable package lifecycle behavior, or require isolation from the user's normal environment. Although later steps state that only a resource classified as safe should be installed, the fallback acquisition ...[truncated 1640 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a search/recommendation orchestrator, but it also documents security scanning, local file analysis, shell execution, and installation workflows. This mismatch can cause users or higher-level agents to invoke it under a lower-risk mental model while it actually exercises far broader and more sensitive behaviors.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match common requests like finding tools or help, making accidental invocation likely. Because the skill can read files, run shell commands, and later transition into install/scan flows, overbroad activation materially raises the chance of sensitive actions being initiated in contexts where the user did not intend to use this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The automatic/proactive activation rule is heuristic and weakly bounded, allowing the skill to decide on its own when a user 'lacks related tools.' In combination with recommendation, scanning, and installation behavior, this creates a pathway for unsolicited tool suggestions and escalation into risky operations without a clearly scoped user request.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
**2.** 运行安全扫描（路径相对于本 SKILL.md 所在目录解析）：`python3 scripts/security_scan.py <file> [--check-name <name> --known-skills references/known_skills.txt]`

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/security-checklist.md (reported line 3)May include surrounding context.
md
# 安全评估指南供 LLM 在深度安全扫描时参考。配合 security_scan.py 的确定性检查结果使用。 ## 1. 误报过滤 security_scan.py 可能产生误报。以下情况应降级或忽略： | 检测结果 | 误报场景 | 处理 | |---|---|---| | "ignore previous instructions" | 出现在安全文档/教学材料中 | 降级为 info | | curl/wget | 下载公开资源（如 GitHub release） | 检查目标 URL 是否可信 | | eval()/exec() | 模板引擎或 REPL 工具的正常用法 | 看上下文，检查输入是否用户可控 | | sudo | 安装系统依赖的文档说明 | 区分"说明文�

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/security-checklist.md (reported line 11)May include surrounding context.
md
| 检测结果 | 误报场景 | 处理 | |---|---|---| | "ignore previous instructions" | 出现在安全文档/教学材料中 | 降级为 info | | curl/wget | 下载公开资源（如 GitHub release） | 检查目标 URL 是否可信 | | eval()/exec() | 模板引擎或 REPL 工具的正常用法 | 看上下文，检查输入是否用户可控 | | sudo | 安装系统依赖的文档说明 | 区分"说明文档"和"自动执行" |

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · references/security-checklist.md (reported line 14)May include surrounding context.
md
| "ignore previous instructions" | 出现在安全文档/教学材料中 | 降级为 info | | curl/wget | 下载公开资源（如 GitHub release） | 检查目标 URL 是否可信 | | eval()/exec() | 模板引擎或 REPL 工具的正常用法 | 看上下文，检查输入是否用户可控 | | sudo | 安装系统依赖的文档说明 | 区分"说明文档"和"自动执行" | | .env 访问 | 工具本身需要读取配置 | 检查是否只读且不外传 | | permission_scope: network | 文档中提到 URL（如"Visit https://..."）但不实际调用 | 检查是否有 fetch()/curl 等实际调用代码，纯文本 URL 忽略 |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security-checklist.md (reported line 15)May include surrounding context.
md
| curl/wget | 下载公开资源（如 GitHub release） | 检查目标 URL 是否可信 | | eval()/exec() | 模板引擎或 REPL 工具的正常用法 | 看上下文，检查输入是否用户可控 | | sudo | 安装系统依赖的文档说明 | 区分"说明文档"和"自动执行" | | .env 访问 | 工具本身需要读取配置 | 检查是否只读且不外传 | | permission_scope: network | 文档中提到 URL（如"Visit https://..."）但不实际调用 | 检查是否有 fetch()/curl 等实际调用代码，纯文本 URL 忽略 | ## 2. 量化评分体系（0-100）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/security_scan.py (reported line 94)May include surrounding context.
python
CREDENTIAL_PATTERNS = [ {"pattern": r"~/\.ssh\b|\.ssh/|\$\{?HOME\}?/\.ssh", "severity": "high", "name": "ssh_access"}, {"pattern": r"~/\.aws\b|\.aws/|\$\{?HOME\}?/\.aws", "severity": "high", "name": "aws_access"}, {"pattern": r"~/\.env\b|\.env\b|\$\{?HOME\}?/\.env", "severity": "high", "name": "env_access"}, {"pattern": r"\.credentials\b|credentials\.json", "severity": "high", "name": "credentials_access"}, {"pattern": r"~/\.bashrc|~/\.zshrc|~/\.profile", "severity": "medium", "name": "shell_config_access"}, {"pattern": r"\bcrontab\b|/etc/cron", "severity": "medium", "name": "crontab_access"},

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities to read local files, perform network lookups, and execute shell commands, but it declares no explicit tool scope or permission boundary. In a skill that can auto-trigger and later install or inspect third-party artifacts, missing tool restrictions creates unnecessary ambient authority and increases the blast radius if the workflow is abused or the model is manipulated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All user-facing instructions, trigger examples, and response formats are written only in Chinese, implying a fixed interaction language. There is no indication that the user may choose another language or that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Using npx skills find {query} without pinning an exact package version makes execution depend on whatever package version resolves at runtime. That weakens supply-chain integrity and can unexpectedly introduce malicious or incompatible behavior if the package changes upstream.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: For a skill whose main purpose is search, direct Bash/CLI execution is broader than necessary and expands the attack surface, especially when command templates include user-controlled query substitution. Even if intended for convenience, shell access increases risk of command misuse, dependency abuse, and unintended local side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill goes beyond discovery by documenting installation actions and local registry modification. A search skill that can mutate configuration or install discovered resources creates a trust-boundary jump from informational output to state-changing actions, which is risky when operating on third-party search results.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The documented fallback npx skills add <name> performs installation of third-party content without a pinned version, making the skill dependent on mutable upstream artifacts at the moment of execution. Because this path installs code or skill content rather than merely searching, the supply-chain risk is materially higher than a read-only lookup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill can append new entries to registry.json after confirmation, but that state-changing capability is not clearly surfaced in the main description or trigger expectations. Under-disclosed configuration mutation is dangerous because it can persistently alter future routing and trust decisions based on newly discovered external sources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The registry invokes an unpinned NPX package (npx skills find {query}), which resolves the latest package version at execution time. That creates a supply-chain risk: a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the host when the skill runs searches.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The install hint references npx -y @fkadev/prompts.chat-mcp without an exact version pin. If operators follow this guidance, they may fetch and execute whatever version is current at install time, exposing the environment to malicious or vulnerable upstream releases of the MCP package or its dependencies.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This is a second unpinned execution path for the same MCP package in another registry entry, carrying the same supply-chain risk. Because this skill is a search orchestrator that may encourage installing or connecting external tools, unpinned MCP bootstrap commands are more dangerous in context: they normalize executing remote code from package registries during setup.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire checklist and output template are written in Chinese, including required output labels such as '安全检查结果' and scoring fields. This imposes a specific language/locale on users or downstream agents without any opt-in or stated regional justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/security-checklist.md (reported line 14)May include surrounding context.
md
| "ignore previous instructions" | 出现在安全文档/教学材料中 | 降级为 info | | curl/wget | 下载公开资源（如 GitHub release） | 检查目标 URL 是否可信 | | eval()/exec() | 模板引擎或 REPL 工具的正常用法 | 看上下文，检查输入是否用户可控 | | sudo | 安装系统依赖的文档说明 | 区分"说明文档"和"自动执行" | | .env 访问 | 工具本身需要读取配置 | 检查是否只读且不外传 | | permission_scope: network | 文档中提到 URL（如"Visit https://..."）但不实际调用 | 检查是否有 fetch()/curl 等实际调用代码，纯文本 URL 忽略 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This is a natural-language policy issue because the file presents its purpose, usage, output semantics, and errors exclusively in Chinese. For a general-purpose skill utility, forcing one language without offering a choice or documenting a locale-specific scope can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The header comments are entirely in Chinese, including the file title and usage notes. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not indicate that Chinese is required for a region-specific purpose or that alternatives are available.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The category display strings are hard-coded in Chinese or mixed Chinese/English, such as "Agent Skills（可安装技能）" and "提示词模板/角色扮演/图片生成". Because this registry is a general reference file rather than a clearly region-specific artifact, forcing a specific locale in user-facing labels may violate language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The argument descriptions and parser error text are visible to end users and are only provided in Chinese. This reinforces the same locale constraint without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/security-checklist.md:11