Back to skill

Security audit

Deck Narrative Planner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local presentation-outline helper with no network access or hidden persistence, though it ships unused audit helper code that should be reviewed before repurposing.

Install only if you want a Chinese-language local helper for turning supplied materials into a reviewable deck outline. Use it on intended presentation materials, not broad private directories, and be aware that the script contains inactive audit routines that should not be treated as part of the normal deck workflow unless separately reviewed.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
声明描述的是一个面向演示文稿叙事设计的工具,应主要把输入材料转成 PPT/Deck 结构化故事线。实际代码虽然在某些 mode 下可以把文本整理成结构化报告,但核心实现明显是一个由 spec 驱动的通用分析/审计脚本,支持目录审计、CSV 审计、模式扫描和 Skill 规范检查等与 deck/storytelling 无直接关系的能力。这些能力属于未声明且实质性的功能扩展,表明代码的主要用途与描述不一致。因此应判定为描述与行为存在明显不匹配。

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The built-in pattern scanner searches arbitrary files for secrets, internal URLs, and dangerous shell patterns, which is not justified by the skill’s stated storytelling function. Even though it only reports matches, this effectively adds a lightweight reconnaissance/scanning feature that can expose sensitive material from local content and encourage off-scope use.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script supports directory, CSV, pattern, and skill auditing modes that are unrelated to the declared deck-narrative-planner purpose. This creates a capability mismatch: a presentation-planning skill can be repurposed to inspect repositories and local files, increasing the risk of unintended data discovery and misuse in environments where the skill is trusted for a much narrower task.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
All user-facing documentation and examples are presented only in Chinese, with no indication that other languages are supported or that Chinese output is optional. Under the language/locale policy, a skill should not implicitly force a specific language unless the constraint is documented and justified or the user is offered a choice.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This markdown file presents all user-facing natural-language content in Chinese, including headings, evaluation criteria, and audit conclusions. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises executable capability via `python3` and references local resources and input/output files, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization gap: a caller or runtime may permit broader shell/file access than is necessary, increasing the chance of unintended reads, writes, or command execution beyond the deck-planning task.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The natural-language metadata presented to users is entirely in Chinese for the title and category label, and the file does not indicate that the skill is region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in is a locale/language policy violation.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The entire template, including the title and all section instructions, is written only in Chinese, which implies a fixed language requirement for the skill output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
This code generates user-facing report text entirely in Chinese, such as headings and guidance strings, with no option for the user to select another language. That is a natural-language locale policy concern because it forces a specific language without opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The directory and CSV report functions emit headings, labels, and review guidance in Chinese only. Because the script presents these strings directly to users and does not offer locale selection, it violates the language/locale policy described in SQP-3.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
These functions produce user-visible audit results and error text exclusively in Chinese, again without any opt-in, fallback, or locale documentation. This is a repeated natural-language policy issue affecting multiple output modes of the script.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill_audit path performs package-compliance inspection of a skill directory, including manifest/frontmatter validation and file presence checks, which goes beyond deck narrative planning. This broadens the operational scope of the tool and enables filesystem inspection capabilities that users would not reasonably expect from a presentation-planning skill.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest describes converting materials into deck narrative structure, which suggests content generation from inputs, but the implementation also writes rendered output to an arbitrary filesystem path. File output may be a useful implementation detail, but here it is a generic report writer paired with unrelated audit modes, making the actual behavior broader than the stated skill intent.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
This markdown file presents all user-facing instructions exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or justification is provided. The policy requires flagging forced language constraints unless the skill explicitly offers a choice or documents a justified regional scope.

Vague Triggers

Low
Confidence
78% confidence
Finding
The README provides invocation examples like '把这堆材料整理成 10 页 deck 结构' and '每页给我一句标题', but it does not clearly define when the skill should activate versus when similar ordinary requests should not. Because only examples are given without negative examples or tighter routing constraints, the trigger scope may be interpreted too broadly.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The document is entirely written in Chinese and presents the skill input format and requirements only in that language, with no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, this can be read as a language-specific requirement without explicit opt-in or documented justification.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
This markdown file’s visible headings and instructions are entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.