Customer Voice Synthesizer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:41 AM UTC
• Version: 1.0.0

Overview

This skill is a local Chinese-language customer-voice summarizer that reads user-provided material and writes a user-directed report, with no network access, persistence, or hidden execution path found.

Install only if a Chinese-language customer-feedback summarizer fits your workflow. Review or redact customer data before use, and choose the input and output paths deliberately. The dormant audit code is not active in the shipped configuration, but maintainers should remove or document it to avoid future confusion.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个面向用户研究的“用户原声聚合与 JTBD/阶段组织”工具，核心应围绕客服、销售、评价、访谈内容的整理分析。实际代码并未体现任何特定的 customer-voice/JTBD 语义处理能力，例如来源聚合、访谈摘录归类、JTBD 映射、阶段识别、负面反馈保留机制等。相反，代码主要实现的是一个由 spec 驱动的通用报告生成与审计工具：可扫描目录、分析 CSV 字段、匹配安全/敏感模式、检查 Skill 文件结构。这些能力与声明的主要用途明显不同，且包含未声明的审计/安全扫描能力。因此应判定为描述与实际行为存在实质性不匹配。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code scans arbitrary files and directories for secrets, private URLs, and dangerous shell snippets, which is unrelated to customer research processing and can surface sensitive data from local repositories or documents. Even though it does not exfiltrate data by itself, it materially increases the chance of unauthorized discovery and disclosure of confidential content through generated reports.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The dispatcher supports multiple generic auditing modes such as directory, CSV, pattern, and skill audits that are unrelated to the advertised customer-voice/JTBD purpose. In a skill ecosystem, this kind of capability expansion increases the accessible attack surface and enables repurposing the skill to inspect arbitrary local files and project structures beyond the user's expected workflow.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The README presents all user-facing instructions and usage information exclusively in Chinese. Under the stated policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents all user-facing content in Chinese, including headings, audit results, and conclusions, with no indication that the user can choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale limitation is explicitly justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises executable capabilities via `python3` and references local files for input/output, but it does not declare explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host agent may grant broader file and shell access than users expect, increasing the chance of unintended local file reads/writes or command execution.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file uses Chinese exclusively for headings and instructional content, which can amount to forcing a specific language on users if the skill is expected to serve a general audience. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The title, category label, summary, and input hint are all written in Chinese, indicating a fixed language/locale for the skill. The file does not mention any user opt-in, language selection, or region-specific justification, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire template is written in Chinese and labels the output as a Chinese-language template, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only context. This creates a natural-language policy concern because it appears to enforce a specific language without explicit user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The report generator emits user-facing headings and guidance exclusively in Chinese, such as "结果", "摘要", and follow-up instructions. This enforces a specific language for generated output without offering the user any language choice or documenting a justified locale constraint.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill_audit functionality inspects arbitrary skill/package directories for completeness and metadata structure, which is outside the stated customer-voice mission. This hidden cross-domain capability allows the tool to enumerate and summarize local project contents, creating unnecessary access to unrelated files and making misuse easier in multi-project environments.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all testing instructions and expected outcomes in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.