Back to skill

Security audit

实验室资质合规护栏

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese lab-accreditation compliance checklist skill with no code, persistence, credential access, or hidden behavior.

Use this skill for Chinese laboratory qualification and accreditation drafting or review, but treat its compliance output as advisory and have qualified staff verify current legal and accreditation requirements before publication or submission.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is entirely in Chinese and frames the skill as operating within Chinese regulatory workflows, but it does not explicitly state that Chinese is required nor offer an opt-in or language choice. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The mandated report template and usage guidance require outputs in Chinese labels and phrasing, with no indication that the user may choose another language. This is a language-policy concern because the skill enforces a specific output language rather than offering a choice or documenting a justified restriction.

Content

No source excerpt is available for this finding.