SkillSpector给你们的代码评分为危险

[soh-tetsu]

这个评分不代表你们的代码有问题，但确实会影响用户的感官。

❯ skillspector scan --no-llm .

╭──────────────────────────────────────────────────────────────────────────────╮
│ SkillSpector Security Report                                                 │
╰─────────────────────────────────── v2.5.1 ───────────────────────────────────╯

Skill: darwin-skill
Source: /path/to/darwin-skill
Scanned: 2026-08-05 16:10:14 UTC

        Risk Assessment
 Score           92/100
 Severity        CRITICAL
 Recommendation  DO NOT INSTALL

部分反馈如下：

  HIGH: P2 - Hidden Instructions...
    Location: assets/banner.svg:69
    Confidence: 70%
    Remediation: Audit all comments and invisible characters. Remove any
instructions that direct the agent to perform unauthorized actions. Use plain,
reviewable cont...

  HIGH: TM1 - Tool Parameter Abuse...
    Location: README.md:146
    Confidence: 85%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: TM1 - Tool Parameter Abuse...
    Location: README.md:146
    Confidence: 65%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: TM1 - Tool Parameter Abuse...
    Location: README.md:164
    Confidence: 65%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: TM1 - Tool Parameter Abuse...
    Location: README_EN.md:142
    Confidence: 85%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: TM1 - Tool Parameter Abuse...
    Location: README_EN.md:142
    Confidence: 65%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: TM1 - Tool Parameter Abuse...
    Location: SKILL.md:379
    Confidence: 65%
    Remediation: Validate all tool parameters against an allowlist. Reject
dangerous parameter values (shell=True, --force, -rf /) and use safe
defaults....

  HIGH: YR1 - YARA rule 'agent_skill_destructive_autonomous_actions': Auto...
    Location: README_EN.md:49
    Confidence: 75%
    Remediation: Remove the malware payload or compromised file entirely.
Investigate how it entered the skill and audit all other artifacts for
additional indicators ...