Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
整个 README 以中文呈现，未说明该技能是否仅面向中文用户，亦未提供语言选择或用户自定义输出语言的说明。按规则，若技能在自然语言层面默认强制特定语言而无用户选择，可能构成语言/locale 政策问题。
- Content
Security audit
Compliance Evidence Assembler
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local compliance-evidence report helper with some usability and documentation issues, but no hidden exfiltration, persistence, or destructive behavior was found.
Install only if you want a Chinese-language local helper for organizing audit evidence. Run it on intended evidence folders, review output before sharing it, and avoid pointing it at broad home, credential, or private directories unless that content is meant to be included in the report.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger examples are short, generic phrases that can overlap with ordinary user requests, increasing the chance that this skill is invoked unintentionally in unrelated contexts. In a compliance workflow, accidental activation is less severe than code execution issues, but it can still cause misleading outputs, inappropriate handling of sensitive evidence descriptions, or workflow confusion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing natural-language content only in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises executable capability via
python3and explicitly instructs use of a local script, but it does not declare any explicit tool scope such as allowed tools or permissions. That mismatch weakens policy enforcement and reviewability, because a host agent may permit file reads, file writes, or shell execution without a clearly documented least-privilege boundary.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description and primary instructions are written in Chinese and present the skill identity and expected behavior only in Chinese, with no opt-in or alternative language guidance. This can violate language/locale policy because the skill appears to impose a specific language on users rather than offering a choice or stating a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill file is written in Chinese and provides no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all user-facing headings and instructions exclusively in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language is offered. The file does not indicate that Chinese is required for a region-specific or compliance-justified use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest presents the title, category label, summary, input hint, examples, and risk text entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. That creates a natural-language locale policy issue because the skill appears to require a specific language by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The generated report strings are written in Chinese, including headings, prompts, and next-step instructions, with no option for the user to select another language. This imposes a specific locale in natural-language output and matches the policy category for language or locale violations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The directory report function emits Chinese-only report content such as headings and review guidance, again without any language selection mechanism. Because the file consistently forces one language across outputs, this is a natural-language policy concern rather than a code-security issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
These report-generation branches produce Chinese-only headings and instructions for data and audit output. Users are not offered a language choice, and no justification for the locale restriction appears in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes organizing audit evidence into directories, inventories, and missing-item lists for later review. However, this code also performs content inspection for risky shell patterns, private URLs, and secret-like strings, which is a security scanning capability rather than simple evidence assembly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest positions the skill as assembling audit evidence and identifying missing items, but this function audits another skill package for required files and frontmatter validity. That is a separate packaging/compliance validation capability not clearly covered by the stated evidence-organization purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire template is written in Chinese and presents fixed Chinese section headings and instructions, which implies a specific language output requirement. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-language or region-specific compliance context.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The argument parser description says this is a 'local support script for this Skill,' which conflicts with the manifest's specific purpose of assembling compliance evidence for audit workflows. This documentation understates and obscures the actual operational intent presented to users.
- Content