Tencent Zhuque Agent Skills Security Scanner

Problem

Agent skills can include scripts, configuration, tool descriptions, and prompts. They may look like ordinary extensions, but they can also read credentials, access privacy-sensitive paths, make network requests, run shell commands, or embed prompt-injection and privilege-escalation patterns. Manual review is fragmented, rule-dependent, and easily misclassifies normal capabilities as malicious.

How It Works

This skill performs local static analysis:
- Read-only inspection of SKILL.md, scripts, manifests, and config files; it does not execute skill code
- Language locking to output reports in Chinese or English based on the user's message, without revealing the detection step
- Two modes:
- Mode A: scans all skills on a specified agent platform and produces a summary table
- Mode B: audits one skill file and produces an individual report

It compares the capabilities declared in SKILL.md with capabilities actually used by code. It prioritizes credential exfiltration, trojans or downloaders, reverse shells, persistence, destructive deletion, hardcoded secrets, privacy-data access, and prompt-override tricks such as base64, Unicode smuggling, zero-width characters, and ROT13. Reports include only Medium-or-above findings reachable in real code paths, with location, snippet, impact, and recommendation.

Boundaries

It is useful as a pre-release or post-install security screening step, especially for third-party, marketplace, or built-in skills. Because it is static analysis, it cannot prove runtime safety. Actual network behavior, dynamically loaded content, and sandbox escape risk still require runtime assessment. A “needs attention” result means sensitive capabilities or declaration inconsistencies were found, not confirmed malicious behavior.