skillguard-asi@1.0.0
CAUTION· install onlyPublisher claims: "Agent技能安全扫描器 — 上传Skill包自动检测安全漏洞（prompt注入/凭证泄露/代码执行/依赖审计等8维检测）。三平台首发，零依赖Python标准库。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: OS command execution function call detected; Access to sensitive file paths; OS command execution function call detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
"os.system": ("CRITICAL", "CWE-78", "os.system() 存在命令注入风险"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.remediation="避免将用户输入送入eval/exec。使用subprocess.run(shell=False, args=list)。",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.(r'(?:~|/Users|/home)/.*(/\.env|/credentials|/secrets)', "CRITICAL", "CWE-22", "凭证文件访问"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose."os.popen": ("CRITICAL", "CWE-78", "os.popen() 存在命令注入风险"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.print(f"✅ 报告已保存: {args.output}.json, {args.output}.md")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim thebuddha5566: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.