Security audit

Decision Ledger

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a local meeting-decision organizer, with no evidence of network access, persistence, or destructive behavior, though it includes inactive audit code that should be disclosed or removed.

Install this if you want a local Chinese-language helper for turning meeting notes or project material into a reviewable decision ledger. Be aware that the script contains inactive generic audit functions unrelated to that core purpose; cautious users should prefer a future version that removes or clearly documents those helpers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向会议纪要/项目材料的信息提取器，核心能力应是识别并整理‘决策、负责人、截止时间、假设、撤销条件’等治理语义。实际代码并未实现这类专门抽取逻辑。相反，它从 resources/spec.json 读取配置，根据 mode 在多种完全不同的审计/扫描任务之间切换：structured_brief 只是把输入行切分后分配到章节；directory_audit 会递归扫描目录和 Markdown 标题；csv_audit 会读取表格并统计字段；pattern_audit 会检测潜在危险命令和疑似密钥；skill_audit 会检查 Skill 文件完整性和 frontmatter。虽然 structured_brief 模式能生成某种结构化报告，但它并不语义识别决策或负责人，只是机械地重排文本。整体主用途明显是通用审计/扫描工具，而不是声明中的会议决策提取技能，因此存在实质性描述与行为不符。

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script implements multiple generic auditing modes such as directory, CSV, pattern, and skill repository auditing that are unrelated to the declared decision-ledger purpose. This expands the skill's effective capability from structured decision extraction into broad local filesystem inspection, increasing the risk of unauthorized data discovery and misuse in environments where the skill is trusted for a much narrower task.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The entire skill description is presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This markdown file is entirely written in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale for a region-specific use case. Under the policy, language constraints should either be optional for users or clearly justified.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope or permission boundaries, yet its instructions mention reading local resources, writing output files, and invoking `python3` via shell. This creates an unnecessary capability gap between the declared purpose and the effective power of the skill, increasing the chance of unintended file access or command execution if the runtime grants broad defaults.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s operative instructions and headings are written in Chinese, and the skill does not state that users may choose their preferred language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The template content is entirely written in Chinese, including the title and all section instructions, which implies the skill expects or enforces a specific language. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The generated report strings in make_structured_report are hard-coded in Chinese, and similar Chinese-only output appears throughout the script. This enforces a specific language for users regardless of their locale or preference, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: directory_report, csv_report, pattern_report, skill_audit, and parse_frontmatter return user-facing headings and error messages only in Chinese. Because no opt-in or locale-selection mechanism exists, the skill consistently forces one language across multiple execution paths.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The embedded pattern scanner searches files for secrets, dangerous shell usage, and private URLs, which is not justified by a decision-ledger skill. Even though it is read-only, it can be used to inspect arbitrary local files for sensitive content and disclose matched snippets in output, turning a narrow workflow helper into a reconnaissance tool.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill_audit logic enumerates repository contents and parses packaging metadata for other skills, which is unrelated to extracting decisions from meeting materials. In context, this broadens access to local project structures and metadata and enables cross-repository inspection that users would not expect from the advertised skill.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The entire smoke-test document is written only in Chinese, including the title, instructions, and pass criteria, with no indication that another language is supported or that Chinese is a required locale. Under the policy, a skill should not impose a specific language without user opt-in or clear justification.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This markdown example output fixes the skill’s user-facing content to Chinese throughout the file. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The title, summary, examples, and risk text are presented only in Chinese, which can amount to forcing a specific language without user opt-in. The file does not document that the skill is intended only for Chinese-speaking users or offer any language/locale choice.

Static analysis

No suspicious patterns detected.