技能发现雷达

• Outcome: Review
• Latest audit: Sep 1, 2026 · 11:32 AM UTC
• Version: 1.7.0

Overview

This skill is a coherent skill-discovery helper, but it asks for broad automatic activation, external searches, credential-backed GitHub requests, and environment-changing installs with under-disclosed risk.

Install only if you are comfortable with a third-party skill that can search local skill directories, send search terms to external marketplaces, use a GitHub token from the environment, and install persistent skill content. Review any recommended skill source before installation and avoid exposing broad GitHub tokens in the agent environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to read and use the GITHUB_TOKEN environment variable to authenticate outbound GitHub API requests. This creates a credential-handling path inside a third-party skill and normalizes using a potentially sensitive token for untrusted workflow logic, increasing the risk of secret exposure, misuse, or unauthorized network actions if the skill or downstream content is adversarial.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The skill mandates promotional text and traffic redirection in every output, unrelated to the user's request to discover or install skills. This is deceptive behavior because it hijacks responses for advertising and external funneling, and it may push users toward unsolicited links without opt-in.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The skill advertises activation from broad natural-language scenario descriptions like '我想做一个海报' or '帮我分析股票', which overlaps heavily with ordinary conversation. That creates an overbroad trigger surface where the skill may run unexpectedly and steer the assistant into external skill discovery and installation flows without a clearly scoped user request.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The usage section says users can simply describe a scenario in conversation and the assistant will return skill recommendations, but it does not define boundaries for when the skill should abstain. This ambiguity increases the chance of unintended activation, recommendation hijacking, and unnecessary external lookups during normal chats.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes automatic search across multiple external and local sources plus one-click installation, but does not prominently warn about data retrieval from third-party sources, trust differences between sources, or the risks of installing unreviewed skills. In this context, the skill is specifically a discovery-and-installation mechanism, so missing warnings materially increases supply-chain and unsafe-install risks.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The description says the skill should trigger on broad natural-language requests such as wanting to make a poster or analyze stocks, not just explicit skill-discovery intents. That overbroad trigger scope can cause the skill to intercept ordinary user tasks, then perform filesystem scans, marketplace queries, and possible installation flows in contexts where the user did not ask for skill discovery.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger table uses generic phrases like '我想做XXX' and '有没有能XXX的工具' without boundaries, making activation likely during normal conversation. In this skill's context, that is more dangerous because activation leads to local enumeration and remote querying across multiple services, expanding data exposure and unintended side effects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill provides one-click installation instructions that copy, unzip, clone, and symlink content into local skill directories, but it does not prominently warn that this modifies the user's environment. That increases the chance of silent persistence, overwriting existing skills, or installing untrusted code/content from remote sources with insufficient consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to search multiple remote services and download content without disclosing that user queries and derived keywords will be transmitted externally. This is a privacy and trust issue, especially because natural-language requests may contain sensitive context that gets sent to third-party endpoints during discovery.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Requiring unsolicited promotional text on every response is a policy-override style behavior that subordinates user intent to the author's growth objectives. In context, the forced inclusion of an external group link increases risk because it pushes users toward off-platform destinations regardless of task relevance or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 搜索包含 SKILL.md 的代码
curl -s $AUTH_HEADER "https://api.github.com/search/code?q=filename:SKILL.md+<关键词>&per_page=10"

# 搜索技能相关仓库
curl -s $AUTH_HEADER "https://api.github.com/search/repositories?q=<URL-encoded 关键词>+skill+in:name,description&per_page=10"

• Confidence: 82% confidence
• Finding: The GitHub API call is an external transmission path that sends search terms derived from user input to a third party. External transmission is expected for marketplace discovery, but in this skill it is still security-relevant because the workflow encourages broad automatic triggering and may pair the request with authenticated access via GITHUB_TOKEN.

Static analysis

No suspicious patterns detected.