Dataset Intake Auditor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:41 AM UTC
• Version: 1.0.0

Overview

This is a local dataset-audit helper with no network or persistence, though its script contains inactive broader audit modes that users should review before repurposing it.

This is reasonable to install for local CSV or TSV dataset intake checks. Provide only the dataset files you intend to audit, review any generated Markdown or JSON before sharing it, and note that outputs are in Chinese. Do not modify spec.json to enable the broader directory, pattern, or skill-audit code unless you intentionally want those extra inspections and have reviewed the scope.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A strong description-behavior mismatch is security-relevant because the skill claims to perform bounded dataset intake auditing, while the underlying behavior reportedly supports broader directory enumeration, risk-pattern scanning, package validation, and mode-switching controlled by external `spec.json`. When execution can be redirected by external configuration into unrelated modes, users may authorize the skill under false assumptions and expose more files or workflows than intended.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The pattern scanning logic searches arbitrary files for secrets, private URLs, and shell-risk signatures, which is unrelated to dataset onboarding. In a skill presented as a dataset auditor, this creates covert security-scanning capability that can enumerate sensitive material from local content and exfiltration-adjacent findings through generated reports.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill_audit functionality inspects arbitrary skill repositories for structure and metadata compliance, which is unrelated to validating incoming datasets. This broadens the tool into a generic repository auditor and allows inspection of project contents under false expectations about its operational scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The dispatcher supports multiple generic modes such as directory, pattern, and skill auditing that go well beyond the declared purpose of dataset intake validation. This scope expansion enables the skill to be repurposed to inspect arbitrary local files and repositories, increasing the risk of unintended data exposure and misuse under a misleading trust boundary.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger examples are very broad natural-language phrases like '检查这个数据集能不能接入' and '给出字段和缺失率审计', which can overlap with ordinary data-analysis requests. In a skill-routing system, this can cause over-triggering or accidental invocation of the skill on unrelated prompts, creating prompt-scope confusion and increasing the chance that local files are analyzed when the user did not explicitly intend to use this skill.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all user-facing content in Chinese, and there is no natural-language indication that the skill offers a language choice or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a reportable natural-language policy concern.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises executable behavior via `python3` and implies reading inputs and producing output files, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host may grant broader file or shell access than reviewers or users expect, increasing the chance of unintended file writes or command execution.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill title and core operating instructions are written entirely in Chinese and define the assistant role in Chinese without offering any language choice. This creates a locale/language policy concern because the skill appears to assume a specific language rather than explicitly letting the user opt in or select their preferred language.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire example output is written exclusively in Chinese, and there is no surrounding instruction offering an alternative language or documenting that the skill is intentionally limited to Chinese users. This can violate language/locale policy when a skill implicitly enforces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The output template is entirely in Chinese and does not provide any user language selection or fallback, which can exclude users who do not read Chinese and cause misunderstanding of audit results. In a dataset intake and governance context, misunderstanding field quality, anomalies, or intake recommendations can lead to incorrect operational decisions, although this is primarily an accessibility and usability security-quality issue rather than a direct code-execution risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The title, category label, and summary are all presented in Chinese, and the file does not indicate that the skill is region-specific or that users can choose another language. This creates a natural-language policy concern because the skill appears to enforce a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire template, including the title and all section instructions, is written exclusively in Chinese and gives no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code generates multiple user-facing report sections entirely in Chinese, such as headings, prompts, and next-step guidance. Because the script does not offer a user opt-in or configurable locale, it violates the language/locale policy for natural-language behavior.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Security/code scanning capability is present without justification in the skill description, creating a mismatch between declared and actual behavior. Even without code execution, scanning arbitrary files for sensitive patterns can reveal secrets and internal URLs, making the skill more dangerous because users may grant access believing it only assesses dataset quality.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Auditing arbitrary skill project structure is not justified by the stated dataset-audit purpose and expands the tool's reachable surface to unrelated repositories. This mismatch undermines least privilege and can expose metadata and file inventory from projects that users did not intend to subject to a generic auditor.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire smoke-test document is written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy, a fixed language requirement without opt-in or justification is a natural-language locale violation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file is entirely written in Chinese and includes output-format instructions such as '使用清晰标题' without any indication that the user may choose another language. Under the policy, a skill should not impose a specific language or locale unless there is user opt-in or a clearly documented regional justification.

Static analysis

No suspicious patterns detected.