Data Retention Mapper

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:41 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a local, review-oriented data-retention report generator with no network, persistence, or hidden system-changing behavior.

Install only if you are comfortable with a Chinese-language local reporting skill that processes the retention and storage-location details you provide. Treat its output as a governance draft, not legal advice, and avoid passing unnecessary personal data or secrets into the input file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个面向数据保留治理的专题分析工具，重点应围绕保留周期、存储位置、清理责任和过期处置建议。实际代码并没有实现这些特定语义分析逻辑；它主要是一个由 spec 驱动的通用报告器/审计器。代码可扫描目录、抽样 CSV、匹配安全模式、检查 Skill 文件完整性与 frontmatter，这些能力明显超出且偏离了“数据保留治理”这一声明用途。虽然输出中可能包含 spec sections，从表面上生成相关章节，但核心行为并未内建数据保留规则、生命周期判断、责任归属分析或隐私合规推理。因此描述与实际行为存在明显不匹配。

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest describes a narrowly scoped governance skill for梳理数据保留周期、落盘位置、清理责任与过期处置建议, but the dispatcher supports unrelated modes such as directory audits, CSV profiling, high-risk pattern scanning, and skill package compliance checks. These behaviors are broader generic audit/reporting utilities and do not implement the claimed retention-mapping semantics.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger examples are generic enough that ordinary user requests like '帮我画一张数据留存地图' or '整理保留周期和落盘位置' could activate the skill unintentionally in broader workflows. In an agent environment, ambiguous activation boundaries can cause the skill to process sensitive governance or storage-location information when the user intended a normal conversational response, increasing the chance of over-collection or unintended disclosure in generated outputs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable behavior via `python3 .../scripts/run.py` and references local resources that imply file read/write activity, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a least-privilege and auditability gap: a host may grant broader capabilities than users expect, and reviewers cannot easily verify what the skill is allowed to access or modify.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill title and role description are written entirely in Chinese and present the skill's behavior in that language, with no indication that users may choose another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file presents all user-facing instructions and content exclusively in Chinese, and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate a language/locale policy requiring user opt-in or documented justification for a forced language.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file consists entirely of Chinese headings and instructions, including the workflow note about proceeding only after user confirmation. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The title, category label, summary, and input hint are all written in Chinese, indicating the skill is designed to operate in a fixed language. The file does not provide any indication that users can choose another language or that the locale restriction is intentionally limited to a Chinese-speaking context.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Multiple user-facing report strings are emitted in Chinese, such as headings and guidance text, with no option to select another language. This is a natural-language locale policy concern because the skill forces a specific language rather than allowing user opt-in or documenting a justified regional scope.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The PATTERNS set and pattern_report function search for curl|bash execution, dangerous rm commands, secrets, and private/admin URLs. That capability is aligned with security scanning, not with analyzing retention periods, storage destinations, deletion ownership, or expiry disposition recommendations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: parse_frontmatter and skill_audit validate SKILL.md, README.md, SELF_CHECK.md, resources, examples, and tests for another skill directory. This is a developer packaging/compliance check and is not an obvious requirement for mapping data retention lifecycle information.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The markdown content, including the title and all procedural instructions, is written entirely in Chinese with no indication that the user can choose another language. Under the policy, locale or language constraints should either be optional or clearly justified as region-specific; this file provides neither.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language instructions, headings, examples, and usage guidance are all presented in Chinese, which can amount to a language policy issue if the organization expects skills not to force a specific language without opt-in. The file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific use case.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing natural language exclusively in Chinese, including headings, audit results, and conclusions. Under the stated policy, forcing a specific language without user opt-in or a documented region-specific reason is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The template content is entirely written in Chinese and presents the output structure as fixed, which implies a language requirement without any visible user opt-in or alternative locale choice. This can violate language/locale policy when the skill is expected to adapt to user preferences.

Static analysis

No suspicious patterns detected.