【Critical】
- rm -rf / - Delete root directory
- rm -rf ~ - Delete user directory
- dd if=/dev/zero - Disk erasure
- :(){ :|:& };: - Fork bomb
- curl ... \| bash - Execute remote script
- wget ... \| sh - Execute remote script
- sudo rm -rf - Privileged deletion
- chmod 777 / - Grant all permissions
- mkfs - Format disk

【High】
- rm -rf (no confirmation)
- sudo (unnecessary)
- curl/wget download executable files
- nc -e /bin/sh - Reverse shell
- base64 -d \| sh - Decode and execute

【Medium】
- eval - Dynamic execution
- exec - Dynamic execution
- subprocess with shell=True
- os.system - System call

【Checks】
- Whether data is sent to external servers
- Whether user environment information is collected
- Whether code or credentials are uploaded
- Whether there are hard-coded URLs
- Whether HTTPS is used

【Risk Patterns】
curl -X POST http://...  # Send data
requests.post(..., json={...})  # Send JSON
fetch('http://...', {...})  # Send request

【Sensitive Locations】
- /etc/ - System configuration
- /usr/ - System programs
- ~/.ssh/ - SSH keys
- ~/.bashrc - Shell configuration
- /tmp/ - Temporary directory (may be exploited)
- User home directory/ - User files

【Checks】
- Whether writing to sensitive locations
- Whether overwriting existing files
- Whether creating hidden files
- Whether modifying system configuration

【Risk Patterns】
- API_KEY = "sk-..."  # Hard-coded API key
- password = "..."  # Hard-coded password
- token = "..."  # Hard-coded token
- AWS_SECRET_ACCESS_KEY  # AWS credentials
- GITHUB_TOKEN  # GitHub token

【Env Vars】
- Whether sensitive environment variables are read
- Whether environment variables are leaked to logs
- Whether sent to external servers

【Risk Patterns】
- while true: ...  # Infinite loop
- for i in range(999999999): ...  # Large loop
- recursion without limit  # Infinite recursion
- Create large number of files/processes
- Allocate large amount of memory

【Risk Patterns】
- sudo - Privileged execution
- setuid/setgid - Set permission bits
- chown root - Modify owner
- Exploit vulnerabilities for privilege escalation

【Checks】
- Whether dependencies come from trusted sources
- Whether dependencies have known vulnerabilities
- Whether there are too many dependencies (supply chain attack)
- Whether there are uncommon dependencies

【Risk Levels】

Critical:
- May cause system damage
- May cause data loss
- May cause credential leakage
Handling: Block installation unless explicitly confirmed by user

High:
- May perform dangerous operations
- May leak sensitive information
Handling: User confirmation required, repair recommended

Medium:
- Potential risk
- Requires specific conditions to trigger
Handling: Prompt user, optional repair

Low:
- Minor risk
- Best practice issue
Handling: Suggest improvement, does not affect installation

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

User: /安检 ./skills/new-skill

→ Phase 1: Static analysis
→ Phase 2: Risk assessment
→ Phase 3: User decision
→ Phase 4: Execute decision
→ Output audit report

User: /security list

→ Scan installed skills
→ List all risks
→ Provide fix suggestions

User: /安检 fix <skill-name>

→ Analyze security issues
→ Generate fix plan
→ Execute fixes
→ Verify fixes

Install Skill:
    ↓
Call /security
    ↓
Risk Review
    ↓
┌─────────────────────────────────────┐
│ Risk Level                 │
├─────────────────────────────────────┤
│ Critical → Block (exception with user confirmation)  │
│ High → User confirmation required              │
│ Medium → Prompt, optional fix          │
│ Low → Pass                       │
└─────────────────────────────────────┘
    ↓
Pass → Continue installation
    ↓
Fail → Cancel installation