WorkBuddy环境安全体检

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.0

Overview

This local WorkBuddy health-check skill is mostly purpose-aligned, but its privacy and integrity claims do not fully match the shipped artifacts.

Review before installing. The skill appears locally focused and does not contain network retrieval, exfiltration, persistence, or destructive system changes, but do not share generated reports without checking them because they may contain an absolute backup file path. Treat the attestation hashes as unreliable for this package version because the recorded SKILL.md hash does not match the inspected file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/wb_health_check.py:509

Finding

Absolute Backup Path Disclosed in Generated Markdown Report

Content

View full analysis

Vulnerability Details

File Location: scripts/wb_health_check.py, lines 509–511
Vulnerability Type: Local filesystem metadata disclosure
Risk Level: Low

Complete Code Snippet

python

if zip_path:
    lines.append(f"## 校验对象")
    lines.append(f"- 备份包：`{zip_path}`")

Technical Analysis

find_latest_golden() returns the full path of the selected backup archive, and render_md() writes that path verbatim into the Markdown report. The value can contain a username, mounted-volume name, custom backup location, organizational directory names, or other local filesystem metadata.

This contradicts the privacy guarantee in SKILL.md, which states that reports do not contain backup package paths and display only filenames. The full path is unnecessary for reporting backup freshness or integrity, so its disclosure exceeds the minimum data required for the Skill's declared functionality.

The project contains no automatic network transmission. Exploitation therefore depends on the generated report subsequently being shared, archived in a less trusted location, or synchronized by another system.

Attack Path

1. A user runs the health-check script.
2. find_latest_golden() identifies a backup archive and returns its full local path.
3. render_md() embeds the unredacted path in the generated Markdown report.
4. The report is shared, uploaded, synchronized, or made accessible to another user.
5. The recipient learns local filesystem metadata that the Skill claims not to disclose.

Impact Assessment

This issue does not grant code execution, additional system privileges, credential access, or direct remote access. Its scope is limited to confidentiality of local path metadata present in the report. Depending on directory naming, the disclosure may reveal a local username, storage layout, project or organization names, or backup-management conventions.

Remediation

View remediation

Remediation Suggestions

Replace the absolute path with the archive's basename:

python

if zip_path:
    lines.append("## 校验对象")
    lines.append(f"- 备份包：`{os.path.basename(zip_path)}`")

Additionally:

1. Add tests using a distinctive temporary absolute path and assert that neither the full path nor its parent directories appear in Markdown or JSON output.
2. Assert that the user's home directory is absent from all generated reports.
3. Centralize report sanitization so future path-bearing fields are reduced to filenames or approved relative identifiers.
4. Update the privacy test to validate report contents dynamically rather than merely checking for selected source-code strings.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A description-behavior mismatch is security-relevant because it defeats user consent and review: a skill presented as a local read-only health check may actually audit other scripts, launch subprocesses, and emit different artifacts than advertised. If the real implementation executes target code or performs broader analysis than disclosed, users may expose sensitive files or trigger unintended local code execution under false assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The attestation mandates a specific branding form (using only a designated name and forbidding real names, employer names, or internal paths) without any user opt-in. In a skill context, this can override user or operator preferences and may suppress transparent attribution or incident-response details, which is a policy/security concern even though it is not directly code-execution related.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares broad operational behavior in prose, including running a Python script, reading the local environment, and writing reports, but it does not explicitly constrain tool permissions. That creates an authorization ambiguity where a host agent may grant more capabilities than users expect, especially given the skill metadata mentions 'zero network' while no enforceable scope is declared in the manifest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation section includes generic phrases such as “安不安全”, “稳不稳定”, “维护一下”, and “数据还好吗”, which are broad enough to appear in ordinary conversation outside this skill’s intended context. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not invoke the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script promises that reports will not contain hostnames or personal details, but render_md() includes the full backup package path in the report. Absolute paths commonly embed usernames, home directories, drive layouts, and sometimes host-specific share names, so sharing the generated report can leak environmental and identity information beyond the stated privacy boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's natural-language instructions and labels are presented exclusively in Chinese, including output expectations and user-facing strings, without indicating any language choice or opt-in. Under the policy rule, forcing a specific language or locale without user selection can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/wb_health_security_test.py (reported line 123)May include surrounding context.

python

import subprocess
        tmp = tempfile.mkdtemp(prefix="wb_health_selftest_")
        py = sys.executable
        r = subprocess.run([py, TARGET, "--quick", "--out", tmp],
                           capture_output=True, text=True, timeout=120)
        ran_ok = r.returncode in (0, 1, 2)
        out_files = [f for f in os.listdir(tmp) if f.startswith("wb_health_")]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest includes a natural-language author field written in Chinese characters, but the file provides no indication that the skill supports multiple languages or that this locale choice is intentional and justified. Under the policy, fixed language or locale content without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This SVG contains all user-facing labels and captions in Chinese, including the chart title and axis labels, with no indication that the skill is region-specific or that users can choose another language. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This JSON file contains user-visible natural-language strings such as score labels and test details entirely in Chinese. Under the policy, forcing a specific language without opt-in can be a locale-policy issue, and the file does not indicate that the skill is China-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This Python file performs file writes to security_results.json and security_radar.svg, which are safety-relevant side effects for a code file under the missing-warning rule. Although the module docstring mentions the outputs, the write operations themselves have no confirmation prompt or user-facing disclosure near execution, so users running the script may not receive an explicit warning at runtime.

Content

No source excerpt is available for this finding.