Call Scorecard Builder

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:15 AM UTC
• Version: 1.0.1

Overview

This is a local scorecard drafting skill with no network, persistence, or destructive behavior, though its script includes unused generic audit modes that should remain disabled unless reviewed.

Install only if you want a Chinese-language local helper for drafting call scorecards. Provide only transcript or business context you intend to process, review the generated content before using it for evaluation decisions, and do not modify resources/spec.json to enable the dormant audit modes unless you intentionally want local repository/file inspection.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述聚焦于“通话质检/评分卡/培训反馈”场景，但代码并未体现任何与销售、客服或访谈通话分析直接相关的逻辑，例如音频处理、通话文本专项评分、话术维度生成或培训反馈模板生成。相反，代码的核心能力是读取一个 spec 配置后，对任意输入文本、目录、CSV 文件或 Skill 目录生成通用审计/扫描报告；其中还包含安全模式扫描和技能规范检查等明显未在声明中体现的能力。这些属于实质性的未声明能力，且主用途与声明存在明显偏离，因此应判定为描述与实际行为不匹配。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs security-oriented pattern scanning for secrets, internal URLs, and dangerous shell command fragments across arbitrary files. In a call-scorecard skill, this is an unjustified capability expansion that can surface sensitive material from local content and turns the skill into a generic reconnaissance tool rather than a narrow business-analysis helper.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The dispatcher enables several broad audit modes such as directory, CSV, pattern, and skill-package auditing that are unrelated to the declared call-scorecard purpose. This materially expands the skill’s access and behavior, allowing a user to repurpose it to inspect arbitrary local files and repositories, which increases data-exposure risk and violates least-privilege expectations for the skill context.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger examples are short and generic enough to overlap with ordinary user requests, which can cause the skill to activate when the user did not explicitly intend to invoke it. In a skill-routing system, this can lead to unintended processing of call-related content, unnecessary exposure of sensitive conversation material to the skill, or workflow confusion.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This markdown file presents all user-facing natural language in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable behavior via `python3 {baseDir}/scripts/run.py` and references reading templates/specs and writing output, but it declares no explicit tool scope or permissions. In an agent runtime, this creates ambiguity around what filesystem and shell capabilities the skill is allowed to use, increasing the chance of over-broad execution or unintended access if invoked with attacker-controlled inputs or paths.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The entire skill example is presented only in Chinese, including headings and instructions, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, a language or locale constraint should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown example output is entirely Chinese-language content, and the file does not indicate that the user can choose a language or that Chinese is a documented, justified locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This manifest presents the skill title, summary, examples, and risk text only in Chinese, which effectively constrains the skill to a specific language without any visible opt-in or alternative locale support. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The template title and all instructional content are written in Chinese, which implies the skill output is expected in a fixed language. There is no indication that users can choose another language or that the Chinese-only constraint is documented as region-specific or optional.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The recursive file enumeration function can walk arbitrary directories and collect text-like files for later summarization or scanning. In this skill’s context, that creates unnecessary visibility into local repositories and documents unrelated to call scoring, increasing the chance of over-collection and inadvertent disclosure of sensitive information.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code generates user-facing report text entirely in Chinese, including headings, prompts, and next-step guidance. That forces a specific language/locale for all users without opt-in, which matches the natural-language policy violation criteria.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill can inspect package structure and parse SKILL.md frontmatter, effectively auditing other skill bundles or repositories. That capability is unrelated to generating call scorecards and further broadens the tool into a generic package inspector, increasing unintended access to local metadata and project contents.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: 整个 README 以中文撰写，但未说明该技能是否要求始终以中文输出，或是否支持按用户偏好切换语言。若技能默认强制特定语言而未提供选择，可能构成语言/locale 策略方面的自然语言合规问题。

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file uses Chinese throughout, including the title, instructions, and pass criteria, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.