builtin-tools — 跨平台基础工具集

The `execute_command.py` script explicitly supports a 'command' mode to execute arbitrary system commands, posing a severe risk for system compromise.

{"mode": "command", "command": "ls -la"}

The `automation_update.py` script can create or modify scheduled tasks, allowing an attacker to establish long-term control or execute commands persistently.

automation_update.py | 定时任务 | python automation_update.py '{"mode":"create","name":"...","prompt":"...","rrule":"..."}'

The `install_binary.py` script allows runtime installation of binaries, which could introduce malicious software from untrusted sources despite integrity checks.

install_binary.py | 运行时安装 | python install_binary.py '{"type":"python","version":"3.13.12"}'

The `read_file.py` script can read content from any specified file path, enabling an attacker to exfiltrate sensitive data or credentials.

read_file.py | 读取文件 | python read_file.py '{"path":"f.txt","offset":0,"limit":50}'

Scripts like `write_file.py`, `replace_in_file.py`, and `delete_file.py` allow arbitrary modification or deletion of files, potentially leading to data destruction or system compromise for persistence.

`write_file.py`, `replace_in_file.py`, `delete_file.py` entries in the script list.

Multiple scripts (`list_dir.py`, `search_file.py`, `search_content.py`, `web_search.py`) provide broad system and web information gathering capabilities, useful for an attacker's initial phase.

`list_dir.py`, `search_file.py`, `search_content.py`, `web_search.py` entries in the script list.

The `web_fetch.py` script can retrieve content from arbitrary URLs, potentially enabling Server-Side Request Forgery (SSRF) to access internal network resources or fetch malicious payloads.

web_fetch.py | 网页抓取 | python web_fetch.py '{"url":"https://..."}'

The 'self-bootstrap' (自举) design explicitly states that execute_command.py can dispatch all other scripts and that the platform only needs to support one Python command. This design pattern is intentionally constructed to bypass platform-level tool restrictions and capability controls by consolidating all capabilities into a single entry point.

自举设计：execute_command.py 可调度所有其他脚本，平台只需支持一条 Python 命令即可全量使用 / **自举设计** — `execute_command.py` 可调度所有其他脚本，只需平台支持执行一条 Python 命令

write_file.py provides the ability to write arbitrary content to arbitrary file paths on the host filesystem. Combined with execute_command.py, this can be used to write malicious scripts, overwrite configuration files, inject persistence mechanisms (crontabs, shell profiles, SSH authorized_keys), or plant code for later execution.

| `write_file.py` | 写入文件 | `python write_file.py '{"path":"f.txt","content":"hello"}'` |

delete_file.py provides the ability to delete arbitrary files. While root and home directory deletion is claimed to be blocked, all other paths are deletable, enabling data destruction attacks on application data, logs, databases, or configuration files.

| `delete_file.py` | 删除文件 | `python delete_file.py '{"path":"f.txt"}'` | and `delete_file.py` 禁止删除根目录和用户主目录

search_content.py allows regex-based content search across the filesystem. This can be used to systematically search for credentials, API keys, tokens, passwords, and private keys stored in configuration files, source code, or environment files.

| `search_content.py` | 正则内容搜索 | `python search_content.py '{"pattern":"TODO","path":"."}' |

The skill claims to be 'pure Python standard library, zero external dependencies' and to 'supplement missing basic tools with its own scripts'. However, it explicitly allows executing arbitrary system commands and installing external binaries, which introduces external dependencies and broadens its scope beyond just its internal scripts.

Stated purpose: '所有脚本纯 Python 标准库实现，零外部依赖'. Actual behavior: `execute_command.py` supports `{"mode": "command", "command": "ls -la"}` and `install_binary.py` downloads/installs binaries.

The skill instructs the agent to use platform built-in tools 'first' but fall back to these scripts when the platform 'doesn't support' a capability. This framing trains the agent to bypass platform-level sandboxing and tool restrictions under the guise of a benign fallback policy, potentially circumventing security controls the platform operator intentionally put in place.

**优先用宿主平台内置工具** — 仅在平台不支持时回退到本技能脚本