Competitor Message Differ

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:32 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Chinese competitor-messaging report generator with a simple local Python helper, though its script contains dormant audit modes that are broader than the advertised purpose.

Install this only if you want a Chinese-language local report helper for competitor messaging analysis. Treat input files as visible to the agent running the skill, and avoid pointing modified versions of the script or spec at broad private directories unless you intentionally want local audit-style reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个聚焦竞品分析、信息架构和叙事比较的技能。但代码并未实现任何专门的竞品比较逻辑、信息架构分析逻辑、叙事/定位分析逻辑，甚至没有与竞品、品牌、文案语义分析相关的专用处理。相反，它从 resources/spec.json 读取配置后，按 mode 执行多种通用审计/扫描任务：读取目录中的文本文件、统计扩展名、抽取 Markdown 标题、解析 CSV 字段、扫描 shell/secret/private URL 等风险模式、检查 Skill 文件完整性与 SKILL.md frontmatter。这些能力与“竞品 messaging/positioning 分析”明显不同，且包含未声明的安全扫描与技能规范审计能力。代码访问的资源也主要是本地文件系统中的目录、文本文件、CSV 和 Skill 元数据，而不是用于竞品内容比较的特定输入模型。因此描述与实际行为存在实质性不匹配。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script includes regex-based scanning for secrets, private URLs, and shell-danger patterns, which is unrelated to competitor messaging analysis and materially changes the trust boundary of the skill. Even though it is read-only, this creates a covert security-audit capability that can inspect sensitive local content and surface snippets from matched files, potentially disclosing secrets or internal paths in generated output.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The dispatcher exposes multiple unrelated operating modes such as directory auditing, CSV auditing, pattern scanning, and skill-package auditing even though the declared skill is for competitor messaging differentiation. This capability mismatch is dangerous because it broadens the tool into a generic local file inspection utility, enabling unintended access to user-provided directories and files beyond the advertised purpose and increasing the chance of misuse or deceptive packaging.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README lists example triggers such as '比较我们和竞品的话术差异' and '指出哪些点别模仿' without defining when the skill should or should not activate. These phrases are relatively general for normal product or marketing discussion and the file does not provide scope constraints or negative examples to prevent unintended invocation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises shell-capable execution via `python3` and references reading template/spec resources and writing output files, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this creates ambiguous authority and increases the chance the skill can access or modify local files or invoke commands beyond what users expect from a competitor-messaging analysis workflow.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown example output forces a specific language/locale for the skill's user-facing content. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated report strings in make_structured_report are fixed in Chinese, including headings and guidance text. This imposes a specific language on all users without offering a language choice or documenting a justified locale constraint, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Both directory_report and csv_report emit fixed Chinese headings and explanatory text. Because the script is a general-purpose reporting tool and does not provide opt-in language selection or a documented region-specific limitation, this is a natural-language policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The user-facing strings in pattern_report, parse_frontmatter error messages, and skill_audit are consistently hard-coded in Chinese. Since these messages are shown to users during normal operation and no language selection mechanism exists, the file enforces a locale without opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill_audit functionality inspects arbitrary directories for specific files and parses SKILL.md frontmatter, which is unrelated to analyzing competitor messaging. This is dangerous in context because it encourages filesystem probing under a misleading skill description, exposing repository structure and metadata that users may not expect this skill to access.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This markdown file presents all user-facing content in a single language, Chinese, and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: Multiple user-facing fields such as the title, summary, input hint, examples, and risk note are presented only in Chinese. This can amount to a language-policy issue because the skill appears to force a specific language without offering user opt-in or documenting that it is intended only for a Chinese-language context.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The entire template, including headings and instructions, is written only in Chinese, which implies a fixed language output format. Under the policy criteria, a skill should not force a specific language or locale unless it offers user choice or clearly documents a justified locale constraint.

Static analysis

No suspicious patterns detected.