Security audit

MedXpert 跨机任务箱·低配省算力

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local task queue and Ollama worker; its file writes and command use fit the offline-task purpose, but users should only import sync files they trust.

Install this if you want a local/offline task queue for Ollama-style workflows. Keep passwords and tokens out of task details, import sync packages only from trusted machines, and treat optional DSH/cloud-document setup as separate integrations that may need their own credentials and review.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes and instructs use of local scripts that read and write task files and invoke shell commands (for example Python CLI usage, Ollama commands, and DSH startup), yet no permissions are declared. This creates a transparency and consent gap: a host platform or user may enable the skill without understanding that it can manipulate local files and execute local tooling, increasing the risk of unintended data exposure or command execution.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The import merge trusts task IDs and compares updated_at as raw strings, allowing an imported sync package to overwrite existing tasks solely by claiming the same ID and a newer timestamp. In this offline task-sharing context, a malicious or malformed package could tamper with task status, results, or details, causing integrity loss and potentially hiding or falsifying work records.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list contains broad, common phrases such as '查资料', '总结', 'task queue', and other generic productivity terms that could activate the skill outside its intended context. Over-broad activation can cause the agent to apply task-routing, local execution, or offline workflow guidance when the user did not intend to use this skill, which is especially risky given the skill's file and shell-oriented behavior.

Static analysis

No suspicious patterns detected.