Security audit

避雷.skill

Security checks for vulnerabilities and agentic risk

Overview

The verdict is benign because the findings describe installation and shopping-analysis concerns, not reported intentional harm; confidence is medium and the scan is partial.

Before installing, consider that the verdict is benign but medium-confidence, and the scan is partial: several local references could not be resolved. The results also describe an unpinned installer and a mismatch between the stated shopping purpose and an installation example; the external skill's contents were not verified. Review the installer and target skill before proceeding.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The only supplied behavior is installing a skill from an external repository. That is materially different from providing shopping advice and is not described as part of the declared purpose. The installed skill might implement the advertised features, but its contents are not supplied and cannot be verified. This finding concerns the visible command, not an assertion that the external package is malicious.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The installation example invokes an unpinned npm CLI through npx, which can download and execute a changing package version with the installer's privileges. This is a conditional supply-chain exposure rather than an MCP configuration issue; the supplied content does not establish that the package is malicious.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documented npx command leaves the npm installer version unspecified, potentially executing a newly compromised release with the user's privileges. Although this is not an MCP server reference, it presents a genuine conditional installation-time supply-chain risk.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Repair costs are charged during the warranty period despite documentation stating they begin after coverage ends.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The exposure calculation allocates uncovered repair years starting at year one instead of after the warranty ends, contradicting the documented model. With positive discounting, this overstates repair present value and can distort product rankings; without discounting, the aggregate repair cost remains unchanged, so this is a bounded decision-integrity defect rather than arbitrary code execution.
Content: No source excerpt is available for this finding.

The trigger list includes broad standalone terms such as “对比” (compare), “扫雷” (clear mines), and “梯队” (tiers) without requiring a shopping-related request.

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: Although the description identifies a shopping advisor, several explicitly listed trigger terms also occur in unrelated comparison, gaming, and ranking requests. The trigger list does not explicitly require purchase intent or a product-shopping context, leaving activation scope ambiguous.
Content: No source excerpt is available for this finding.

Requires a verbatim Chinese warning without offering a language choice.

Low

Category: Output Handling
Confidence: 94% confidence
Finding: The instruction requires the first screen to state “该款无任何独立实测” verbatim when independent testing is unavailable. This fixes user-facing output in Chinese without user opt-in or a documented justification for that language constraint.
Content: No source excerpt is available for this finding.