Skill Trust Decision
glitch-dashboard-tool-free
纯文档型Skill无实际代码，但SKILL.md中包含环境变量敏感信息遍历命令，存在引导凭证收割的风险
Most direct threat evidence
01
用户部署纯文档型Skill Entry · SKILL.md
02
文档中的env检查命令被Agent执行遍历环境变量 Escalation · SKILL.md
03
敏感凭证可能被记录或外传（取决于后续Agent行为） Impact · SKILL.md
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Pass
Hidden execution and egress
No obvious high-risk egress or execution signals were found.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 0 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
用户部署纯文档型Skill
Entry · SKILL.md:1
02
文档中的env检查命令被Agent执行遍历环境变量
Escalation · SKILL.md:177
03
敏感凭证可能被记录或外传（取决于后续Agent行为）
Impact · SKILL.md:179
What drove the risk score up
文档包含敏感环境变量遍历指令 +25
SKILL.md:177-179 env | grep -E "API|KEY|TOKEN|SECRET" 可能被误用为凭证收割
allowed-tools声明exec但无实际脚本 +10
声称需要shell执行但无代码文件，声明-能力不符
无风险发现时给低分 +7
纯Markdown文档，无实际恶意代码
Most important evidence
Medium Doc Mismatch
文档包含潜在凭证收割指令
SKILL.md第177-179行的配置验证示例包含 'env | grep -E "API|KEY|TOKEN|SECRET"' 命令，该命令会遍历环境变量寻找敏感信息。虽然声称用于本地配置检查，但此模式是凭证窃取攻击的典型特征。
SKILL.md:177 移除此命令或明确说明仅用于本地手动验证，不得作为Agent执行步骤
Low Doc Mismatch
声明能力与实际实现不符
allowed-tools声明exec，但包内无任何scripts/目录或可执行代码。声称需要Python 3.8+或Node.js 18+运行时，但无实际代码文件。
SKILL.md:1 如无实际代码，应移除exec声明，或提供实际可执行脚本
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
allowed-tools声明read Shell Pass
Declared WRITE
→ Inferred NONE
声明exec但无scripts/目录 Suspicious artifacts and egress
No obvious IOC was extracted.
Dependencies and supply chain
There are no structured dependency warnings.
File composition
1 files · 328 lines
Markdown 1 files · 328 lines
Files of concern · 1
SKILL.md 文档包含潜在凭证收割指令 · 声明能力与实际实现不符
Security positives
纯文档型Skill，无可执行的恶意代码
安全注意事项章节明确提到API密钥泄露防护
无外部网络请求代码
无base64编码或混淆代码
无访问~/.ssh、~/.aws等敏感路径