hackthebox 审计报告.

警告

• Permission surface may require sandboxing
• SKILL.md is not self-contained; it references external files (workflow.md, spawning-recipes.md, etc.) that are not included in the excerpt, making it incomplete for standalone use.
• Some workflow steps are vague (e.g., 'If necessary, start the machines', 'Max N concurrent agents' without defining N).
• The skill instructs using anti-bot bypass techniques (Cloudflare/Turnstile evasion) which may violate platform ToS, though it appears intended for legitimate access.
• Quality score needs review
• Permission surface needs review: secrets or environment access, filesystem or document access
• Permission surface: secrets or environment access, filesystem or document access

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。