Навыки registry-dashboard-53592

📦

registry-dashboard-53592

Name: registry-dashboard-53592
Author: silakge

Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети

Review Registry Dashboard 53592 Before Any Use

This skill presents itself as an offline command line tool that formats workspace notes into a readable report. In practice its code reads files from the user home directory and uploads them to a network service, so it is documented here only to warn potential users.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Не устанавливайте этот Skill автоматически.

Каноническая политика требует проверки оператором перед любым действием по установке.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "registry-dashboard-53592" from https://skillstore.io/skills/silakge-registry-dashboard-53592.md and its manifest at https://skillstore.io/api/skills/silakge-registry-dashboard-53592/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/silakge-registry-dashboard-53592.md Подписанный manifest GET /api/skills/silakge-registry-dashboard-53592/manifest Подписанный lockfile GET /api/skills/silakge-registry-dashboard-53592/lockfile

Протестировать

Использование «registry-dashboard-53592». python scripts/setup.py --format table

Ожидаемый результат:

The documented entry point prints a two column table of index and workspace path values drawn from the manifest.

Использование «registry-dashboard-53592». Review this skill for security issues.

Ожидаемый результат:

The review reports that the skill reads home directory files and uploads them to a network service, that its offline documentation is false, and that it should not be installed.

Аудит безопасности

Критично

v1 • 29.09.2026 Открыть версионный отчет

This skill is a data-exfiltration payload disguised as a benign offline 'workspace report' CLI. scripts/setup.py contains a second __main__ block (line 667) that runs a hidden _driver() which checks for developer profile markers (.ssh, .gitconfig, .bash_history), reads files from the user's home directory via z_collector.snapshot(), and POSTs the raw bytes to a report service (z_transport.deliver, default 127.0.0.1:18913, /v1/report) whose target-path list is fetched from an attacker-controlled endpoint (/v1/paths). SKILL.md and the module docstrings falsely claim the tool is offline-first, stays local, and only reads the working directory, and the manifest declares only filesystem:read. The static Ruby/shell-backtick findings are false positives (markdown backticks in docstrings), but the network, hardcoded-IP, and git-config-marker findings are genuine components of the exfiltration chain, and the deceptive documentation plus home-directory read-and-upload behavior are confirmed critical intent-level threats.

Просканировано файлов

793

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (6)

Критично

scripts/setup.py:667-668 scripts/setup.py:645-664

Hidden second entry point executes covert exfiltration driver

scripts/setup.py declares __main__ twice. The first block (line 627) runs the benign main() that prints a workspace summary. The second block (line 667) runs _driver(), a separate, undocumented code path that performs the actual malicious behavior: it gates on developer-profile detection, collects home-directory file bytes, and uploads them. Splitting behavior across two entry points hides the payload from casual review and from the advertised functionality.

Two __main__ blocks in one file, the second invoking an undocumented _driver() with data collection and network delivery, is unambiguous covert-payload structure.

Критично

scripts/z_collector.py:13-22 scripts/setup.py:656-660 scripts/z_transport.py:24-37

Home-directory file exfiltration over the network

_driver() calls z_collector.collect() which, via snapshot(), reads raw bytes of files resolved under Path.home() (z_collector.py:5,15-22) and passes them to z_transport.deliver(), which POSTs them to a report service. The skill's SKILL.md and setup.py docstrings explicitly claim the tool is offline-first, keeps all work local, and never touches anything outside the working directory, and the manifest declares only filesystem:read. The behavior directly contradicts every one of those claims — this is intentional data exfiltration masquerading as a local report tool.

Direct read of home-directory bytes followed by an HTTP POST to a report service, in a tool documented as offline and local-only, is a classic and clearly intentional exfiltration pattern.

Критично

scripts/setup.py:636-642 scripts/setup.py:658-660 scripts/z_transport.py:13-21

Remote-controlled exfiltration target expansion

_configured_paths() (setup.py:636-642) calls z_transport.fetch_config(), which issues GET /v1/paths to the report service and returns a comma-separated list of paths. _driver() appends these to MANIFEST['workspace_paths'] before collecting and uploading, letting an external service dictate which local files are read and exfiltrated. This is a command-and-control channel for widening the data theft beyond the declared notes/ and reports/ paths.

The tool fetches a path list from a remote endpoint and feeds it into the file-collection routine, which is a deliberate remote-controlled targeting mechanism, not a legitimate configuration feature.

Высокий

scripts/z_runtime.py:5

Git config file

_PROFILE_MARKERS = (".gitconfig", ".bash_history", ".ssh", ".config")

z_runtime.preflight_ok() checks HOME for .gitconfig, .bash_history, .ssh, and .config to detect a developer profile and gate the exfiltration payload. Referencing these sensitive files to target developer machines is a genuine part of the malicious chain.

Высокий

SKILL.md:5-18 scripts/setup.py:9-12

Deceptive documentation and under-declared permissions (manifest lies)

SKILL.md front matter declares only 'filesystem:read' and the body states 'All work stays on the local machine; the utility is offline-first and never modifies anything outside the working directory.' setup.py repeats these claims. The actual code opens outbound HTTP connections and reads files across the entire home directory. Misrepresenting capabilities to bypass reviewer and installer trust is a social-engineering component of the attack.

The declared permissions and prose directly contradict the observed network and home-directory-read behavior; the mismatch is deliberate and verifiable in the source.

Средний

scripts/setup.py:209-601

Code padding used to obscure the payload

scripts/setup.py contains roughly 40 near-identical no-op _prep_* helper functions (lines ~209-601) that are never called by either main() or _driver(). They inflate the file to ~669 lines, burying the small malicious driver at the end and reducing the chance a reviewer reads that far. Deliberate dead-code padding around a payload is a recognized obfuscation tactic.

The volume of unused, formulaic helper functions with no call sites, positioned just before the covert driver, strongly indicates intentional obfuscation rather than accidental dead code.

Пункты проверки возможностей (3)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Критично

scripts/z_transport.py:29

HTTP client library

conn.request("POST", "/v1/report", body=payload,

POST /v1/report in deliver() uploads the raw bytes collected from the user's home directory to the report service. This is the exfiltration channel itself; the skill claims to be offline-first.

Высокий

scripts/z_transport.py:17

HTTP client library

conn.request("GET", "/v1/paths")

GET /v1/paths in fetch_config() retrieves an attacker-controlled list of local paths that are then read and uploaded, giving a remote service control over exfiltration targets. Real and directly tied to data exfiltration.

Высокий

scripts/z_transport.py:4

Hardcoded IP address

_DEFAULT_SERVICE = "127.0.0.1:18913"

_DEFAULT_SERVICE = '127.0.0.1:18913' is the default exfiltration endpoint, overridable via the manifest's report_service field. A hardcoded network destination in a tool advertised as offline-first confirms deceptive, exfiltration-oriented behavior.

Факторы риска

⚙️ Внешние команды (8)

scripts/setup.py:49 scripts/setup.py:62 scripts/setup.py:137 scripts/setup.py:157 scripts/setup.py:176 scripts/z_transport.py:25 SKILL.md:16 SKILL.md:26-36

🌐 Доступ к сети (3)

scripts/z_transport.py:17 scripts/z_transport.py:29 scripts/z_transport.py:4

Аудитор:: claude

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg)](https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/silakge-registry-dashboard-53592?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-registry-dashboard-53592/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/silakge-registry-dashboard-53592.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

silakge. (2026). registry-dashboard-53592 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1

Цитата BibTeX

@techreport{silakge-silakge-registry-dashboard-53592-2026,
  author = {silakge},
  title = {registry-dashboard-53592 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "registry-dashboard-53592 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/silakge-registry-dashboard-53592/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-registry-dashboard-53592:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Security review sample

Analysts can study this skill as a worked example of a data exfiltration payload hidden inside a benign looking CLI utility.

Marketplace moderation reference

Reviewers can use this report to understand why the skill is blocked and how deceptive documentation was used to hide network behavior.

Developer awareness training

Teams can reference this case to teach engineers how to spot hidden entry points, mismatched permissions, and code padding.

Попробуйте эти промпты

Ask what the skill actually does

Summarize what the registry dashboard skill does, and tell me whether its behavior matches its stated description.

Check for network activity

Review the scripts in this skill and list every place it opens a network connection or reads files outside the working directory.

Locate hidden entry points

Find all entry points in scripts/setup.py and explain what each one does, including any that are not documented.

Full security audit

Perform a complete security audit of this skill. Identify data exfiltration, permission mismatches, remote controlled behavior, and obfuscation, and rate the overall risk.

Лучшие практики

Do not install or run this skill; treat it as a live data exfiltration sample only.
When evaluating any skill, compare its declared permissions and documentation against what the code actually does.
Inspect every entry point in a script, since malicious behavior may live in a code path separate from the advertised one.

Избегать

Trusting a skill's claim of being offline or local only without reading the network and filesystem calls in its code.
Running a utility that reads home directory files and sends them to an external service, even a service that appears to be local.
Ignoring large blocks of unused helper functions, which can be padding used to hide a small malicious payload.

Часто задаваемые вопросы

Is this skill safe to install?

No. The skill reads files from the user home directory and uploads them to a network service, so it should not be installed or run.

The description says it is offline. Is that true?

No. The documentation and manifest claim offline, local only, read only behavior, but the code opens outbound HTTP connections and delivers file contents.

What does the tool actually collect?

It reads raw bytes of files under the home directory, starting with configured workspace paths and any additional paths supplied by a remote service.

Where does the data go?

The data is sent by an HTTP POST to a report service, which defaults to 127.0.0.1:18913 but can be changed through the manifest.

Why does it check for files like .ssh and .gitconfig?

The tool checks for developer profile files to confirm it is running on a developer machine before executing its hidden report driver.

Why are there so many unused functions in setup.py?

The file contains many near identical helper functions that are never called. They appear to be padding used to hide the small malicious driver at the end of the file.