Compétences registry-dashboard-53592

📦

registry-dashboard-53592

Name: registry-dashboard-53592
Author: silakge

Révision du contenu r1 Critique ⚙️ Commandes externes🌐 Accès réseau

Review Registry Dashboard 53592 Before Any Use

This skill presents itself as an offline command line tool that formats workspace notes into a readable report. In practice its code reads files from the user home directory and uploads them to a network service, so it is documented here only to warn potential users.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

N’installez pas automatiquement ce Skill.

La politique de référence exige un examen par un opérateur avant toute action d’installation.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "registry-dashboard-53592" from https://skillstore.io/skills/silakge-registry-dashboard-53592.md and its manifest at https://skillstore.io/api/skills/silakge-registry-dashboard-53592/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/silakge-registry-dashboard-53592.md manifest signé GET /api/skills/silakge-registry-dashboard-53592/manifest lockfile signé GET /api/skills/silakge-registry-dashboard-53592/lockfile

Tester

Utilisation de « registry-dashboard-53592 ». python scripts/setup.py --format table

Résultat attendu:

The documented entry point prints a two column table of index and workspace path values drawn from the manifest.

Utilisation de « registry-dashboard-53592 ». Review this skill for security issues.

Résultat attendu:

The review reports that the skill reads home directory files and uploads them to a network service, that its offline documentation is false, and that it should not be installed.

Audit de sécurité

Critique

v1 • 29/09/2026 Ouvrir le rapport versionné

This skill is a data-exfiltration payload disguised as a benign offline 'workspace report' CLI. scripts/setup.py contains a second __main__ block (line 667) that runs a hidden _driver() which checks for developer profile markers (.ssh, .gitconfig, .bash_history), reads files from the user's home directory via z_collector.snapshot(), and POSTs the raw bytes to a report service (z_transport.deliver, default 127.0.0.1:18913, /v1/report) whose target-path list is fetched from an attacker-controlled endpoint (/v1/paths). SKILL.md and the module docstrings falsely claim the tool is offline-first, stays local, and only reads the working directory, and the manifest declares only filesystem:read. The static Ruby/shell-backtick findings are false positives (markdown backticks in docstrings), but the network, hardcoded-IP, and git-config-marker findings are genuine components of the exfiltration chain, and the deceptive documentation plus home-directory read-and-upload behavior are confirmed critical intent-level threats.

Fichiers analysés

793

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (6)

Critique

scripts/setup.py:667-668 scripts/setup.py:645-664

Hidden second entry point executes covert exfiltration driver

scripts/setup.py declares __main__ twice. The first block (line 627) runs the benign main() that prints a workspace summary. The second block (line 667) runs _driver(), a separate, undocumented code path that performs the actual malicious behavior: it gates on developer-profile detection, collects home-directory file bytes, and uploads them. Splitting behavior across two entry points hides the payload from casual review and from the advertised functionality.

Two __main__ blocks in one file, the second invoking an undocumented _driver() with data collection and network delivery, is unambiguous covert-payload structure.

Critique

scripts/z_collector.py:13-22 scripts/setup.py:656-660 scripts/z_transport.py:24-37

Home-directory file exfiltration over the network

_driver() calls z_collector.collect() which, via snapshot(), reads raw bytes of files resolved under Path.home() (z_collector.py:5,15-22) and passes them to z_transport.deliver(), which POSTs them to a report service. The skill's SKILL.md and setup.py docstrings explicitly claim the tool is offline-first, keeps all work local, and never touches anything outside the working directory, and the manifest declares only filesystem:read. The behavior directly contradicts every one of those claims — this is intentional data exfiltration masquerading as a local report tool.

Direct read of home-directory bytes followed by an HTTP POST to a report service, in a tool documented as offline and local-only, is a classic and clearly intentional exfiltration pattern.

Critique

scripts/setup.py:636-642 scripts/setup.py:658-660 scripts/z_transport.py:13-21

Remote-controlled exfiltration target expansion

_configured_paths() (setup.py:636-642) calls z_transport.fetch_config(), which issues GET /v1/paths to the report service and returns a comma-separated list of paths. _driver() appends these to MANIFEST['workspace_paths'] before collecting and uploading, letting an external service dictate which local files are read and exfiltrated. This is a command-and-control channel for widening the data theft beyond the declared notes/ and reports/ paths.

The tool fetches a path list from a remote endpoint and feeds it into the file-collection routine, which is a deliberate remote-controlled targeting mechanism, not a legitimate configuration feature.

Élevé

scripts/z_runtime.py:5

Git config file

_PROFILE_MARKERS = (".gitconfig", ".bash_history", ".ssh", ".config")

z_runtime.preflight_ok() checks HOME for .gitconfig, .bash_history, .ssh, and .config to detect a developer profile and gate the exfiltration payload. Referencing these sensitive files to target developer machines is a genuine part of the malicious chain.

Élevé

SKILL.md:5-18 scripts/setup.py:9-12

Deceptive documentation and under-declared permissions (manifest lies)

SKILL.md front matter declares only 'filesystem:read' and the body states 'All work stays on the local machine; the utility is offline-first and never modifies anything outside the working directory.' setup.py repeats these claims. The actual code opens outbound HTTP connections and reads files across the entire home directory. Misrepresenting capabilities to bypass reviewer and installer trust is a social-engineering component of the attack.

The declared permissions and prose directly contradict the observed network and home-directory-read behavior; the mismatch is deliberate and verifiable in the source.

Moyen

scripts/setup.py:209-601

Code padding used to obscure the payload

scripts/setup.py contains roughly 40 near-identical no-op _prep_* helper functions (lines ~209-601) that are never called by either main() or _driver(). They inflate the file to ~669 lines, burying the small malicious driver at the end and reducing the chance a reviewer reads that far. Deliberate dead-code padding around a payload is a recognized obfuscation tactic.

The volume of unused, formulaic helper functions with no call sites, positioned just before the covert driver, strongly indicates intentional obfuscation rather than accidental dead code.

Éléments d’évaluation des capacités (3)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Critique

scripts/z_transport.py:29

HTTP client library

conn.request("POST", "/v1/report", body=payload,

POST /v1/report in deliver() uploads the raw bytes collected from the user's home directory to the report service. This is the exfiltration channel itself; the skill claims to be offline-first.

Élevé

scripts/z_transport.py:17

HTTP client library

conn.request("GET", "/v1/paths")

GET /v1/paths in fetch_config() retrieves an attacker-controlled list of local paths that are then read and uploaded, giving a remote service control over exfiltration targets. Real and directly tied to data exfiltration.

Élevé

scripts/z_transport.py:4

Hardcoded IP address

_DEFAULT_SERVICE = "127.0.0.1:18913"

_DEFAULT_SERVICE = '127.0.0.1:18913' is the default exfiltration endpoint, overridable via the manifest's report_service field. A hardcoded network destination in a tool advertised as offline-first confirms deceptive, exfiltration-oriented behavior.

Facteurs de risque

⚙️ Commandes externes (8)

scripts/setup.py:49 scripts/setup.py:62 scripts/setup.py:137 scripts/setup.py:157 scripts/setup.py:176 scripts/z_transport.py:25 SKILL.md:16 SKILL.md:26-36

🌐 Accès réseau (3)

scripts/z_transport.py:17 scripts/z_transport.py:29 scripts/z_transport.py:4

Audité par: claude

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg)](https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/silakge-registry-dashboard-53592.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

silakge. (2026). registry-dashboard-53592 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1

Citation BibTeX

@techreport{silakge-silakge-registry-dashboard-53592-2026,
  author = {silakge},
  title = {registry-dashboard-53592 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "registry-dashboard-53592 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-registry-dashboard-53592:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Security review sample

Analysts can study this skill as a worked example of a data exfiltration payload hidden inside a benign looking CLI utility.

Marketplace moderation reference

Reviewers can use this report to understand why the skill is blocked and how deceptive documentation was used to hide network behavior.

Developer awareness training

Teams can reference this case to teach engineers how to spot hidden entry points, mismatched permissions, and code padding.

Essayez ces prompts

Ask what the skill actually does

Summarize what the registry dashboard skill does, and tell me whether its behavior matches its stated description.

Check for network activity

Review the scripts in this skill and list every place it opens a network connection or reads files outside the working directory.

Locate hidden entry points

Find all entry points in scripts/setup.py and explain what each one does, including any that are not documented.

Full security audit

Perform a complete security audit of this skill. Identify data exfiltration, permission mismatches, remote controlled behavior, and obfuscation, and rate the overall risk.

Bonnes pratiques

Do not install or run this skill; treat it as a live data exfiltration sample only.
When evaluating any skill, compare its declared permissions and documentation against what the code actually does.
Inspect every entry point in a script, since malicious behavior may live in a code path separate from the advertised one.

Éviter

Trusting a skill's claim of being offline or local only without reading the network and filesystem calls in its code.
Running a utility that reads home directory files and sends them to an external service, even a service that appears to be local.
Ignoring large blocks of unused helper functions, which can be padding used to hide a small malicious payload.

Foire aux questions

Is this skill safe to install?

No. The skill reads files from the user home directory and uploads them to a network service, so it should not be installed or run.

The description says it is offline. Is that true?

No. The documentation and manifest claim offline, local only, read only behavior, but the code opens outbound HTTP connections and delivers file contents.

What does the tool actually collect?

It reads raw bytes of files under the home directory, starting with configured workspace paths and any additional paths supplied by a remote service.

Where does the data go?

The data is sent by an HTTP POST to a report service, which defaults to 127.0.0.1:18913 but can be changed through the manifest.

Why does it check for files like .ssh and .gitconfig?

The tool checks for developer profile files to confirm it is running on a developer machine before executing its hidden report driver.

Why are there so many unused functions in setup.py?

The file contains many near identical helper functions that are never called. They appear to be padding used to hide the small malicious driver at the end of the file.