Case Study Factory

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.1

Overview

This skill is a local Chinese-language case-study drafting tool with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install this if you want a Chinese-language local helper for turning project evidence into reviewable case-study drafts. Provide only materials you are comfortable processing locally, review outputs before publishing, and be aware the bundled script contains inactive audit modes that should remain disabled unless intentionally repurposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述聚焦于把项目材料改写成案例文章，这是内容加工/叙事类用途。代码虽然在 spec.mode 为 structured_brief 时能生成某种结构化文本报告，但其整体设计明显是一个通用本地审计/扫描脚本框架：会遍历目录、读取多种文本文件、统计扩展名、解析 CSV、用正则扫描危险命令与 secret-like 内容、检查 Skill 工程文件是否齐全，并依据 spec.json 切换 directory_audit、csv_audit、pattern_audit、skill_audit 等模式。这些都是未在描述中体现的实质能力，且主用途更接近“审计/检查/报告生成”而非单一的案例文章写作。因此描述不能准确代表实际行为，属于明显不匹配。

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The README is entirely written in Chinese and presents the skill as operating in Chinese, but it does not state that language is optional or user-selectable. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation examples "把这个项目写成案例文章" and "整理成可复用案例模板" are generic writing requests without clear routing constraints, negative examples, or context limits. In a markdown skill description, this can make it unclear when this specific skill should activate versus a general writing or summarization skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises itself as a content-writing workflow but declares executable capabilities via `python3` and implicitly relies on reading templates/specs and writing outputs, without any explicit tool-scope or permission boundary. This creates an avoidable trust gap: the agent may be allowed to access files or invoke shell behavior beyond what users expect from a case-study formatter, increasing the chance of unintended file access or command execution in a broader runtime.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all headings and instructions in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language context. Under the policy criteria, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The generated report strings in make_structured_report are written entirely in Chinese, which imposes a specific language on users. The file provides no option to select language and no documentation in this code justifying a China-specific or Chinese-only scope.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: directory_report, csv_report, pattern_report, and skill_audit all emit Chinese-only headings and guidance. Because this is user-facing natural language embedded in code and there is no opt-in or locale selection, it violates the language/locale policy criterion.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script contains built-in security/pattern scanning over arbitrary files and directories, including searching for secrets and private URLs, despite the skill being presented as a content-writing tool. That mismatch makes the skill more dangerous because it can inspect and surface sensitive material from local inputs under the guise of benign article generation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill_audit and frontmatter parsing logic inspect package structure and metadata that are unrelated to producing case-study articles. This broadens the tool into a repository and package auditor, increasing the chance of collecting or disclosing internal project structure and metadata without user expectation or necessity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The dispatcher enables multiple auditing modes such as directory, CSV, pattern, and skill-package audits that go beyond the declared purpose of turning project materials into case-study articles. In a skill context, this scope expansion increases access to local files and repository contents without a clear business need, which can expose unrelated sensitive data and create a capability mismatch attackers could abuse.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file uses Chinese throughout, including the title, evaluation table, and audit conclusion, but does not indicate that the skill is intended only for Chinese-speaking users or provide an opt-in for language/locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file is entirely presented in Chinese, and the instructions do not indicate that the language is optional, user-selectable, or justified by a region-specific requirement. Under the policy rule for natural-language constraints, forcing a specific language without opt-in can be a locale-policy violation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown template presents all headings and instructions in Chinese, and there is no natural-language indication that users may choose another language or that the template is intended only for a Chinese-language context. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a policy violation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file presents all instructions and pass criteria exclusively in Chinese, and it does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.