Security audit

Doc Gap Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language documentation audit helper that is broadly coherent with its stated purpose and does not show hidden exfiltration, persistence, or destructive behavior.

Install only if you want a Chinese-language local documentation-directory auditor. Provide narrow documentation paths, prefer dry-run/stdout when reviewing sensitive repositories, and avoid pointing it at broad personal or credential-containing directories. The packaged default is benign, but the unused broader audit helpers should be treated as implementation baggage rather than part of the normal workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A description-behavior mismatch is security-relevant because it undermines informed consent and policy enforcement: users may invoke a 'doc gap finder' expecting narrow markdown analysis, while the implementation supports broader auditing behaviors and writing results to files. When a skill's effective capability exceeds its declared purpose, it can be routed into contexts where more powerful access is inappropriate, leading to over-collection or unintended modification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The pattern scanning logic searches arbitrary files and directories for secrets, shell one-liners, and private URLs, which is outside a normal docs-audit workflow. Even without exfiltration code, this capability can expose sensitive data from unintended locations and materially changes the trust and data-access profile of the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The dispatcher enables multiple modes unrelated to the advertised documentation-gap purpose, including directory, CSV, pattern, and skill audits. This scope expansion increases the accessible attack surface and permits broader filesystem inspection than users would reasonably expect from the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill documentation is entirely presented in Chinese and does not indicate whether the skill must operate in Chinese, whether other languages are supported, or whether the locale is region-specific by design. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The activation examples "扫描 docs 目录找缺口" and especially "帮我看哪些文档可能过期或重复" describe common document-review requests without clear invocation boundaries or exclusions. The README does not define a narrow trigger scope, explicit command list, or negative examples to distinguish when this skill should activate versus general assistance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire self-check document is written in Chinese with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises read-only document analysis, but its content explicitly permits shell execution and references output-file generation, while declaring no explicit tool scope. That combination creates an authorization gap: a caller or runtime may grant broader file and shell capabilities than users would reasonably expect from the metadata, increasing the chance of unintended file access or command execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Authorizing shell/exec for a nominally read-only documentation audit expands the attack surface beyond what the task requires. Even though the example command is fixed to a local script, allowing command execution in skill instructions can enable abuse through crafted inputs, path manipulation, or future script changes, and it weakens the safety boundary promised elsewhere in the document.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire example output is presented only in Chinese, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-language context. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents all headings and guidance in Chinese, which can impose a specific language on users without any visible opt-in or justification. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This manifest presents the title, summary, examples, and risk disclosure entirely in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template title and all section headings and instructions are written exclusively in Chinese, which implies the skill output is constrained to a specific language. There is no indication that users can choose another language or that the Chinese-only requirement is justified as a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated report strings are hard-coded in Chinese, including titles, summaries, and action prompts. This imposes a specific language on all users without opt-in or justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Directory and CSV report functions emit headings and explanatory text only in Chinese. Because the file provides no mechanism for locale selection or clear region-specific limitation, this is a natural-language policy concern across these paths as well.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: These functions produce Chinese-only status messages, findings headers, and remediation prompts. The behavior is consistent across multiple modes and still lacks any user opt-in or documented rationale for the locale restriction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill-audit mode inspects other skill packages for structure and frontmatter compliance, which is unrelated to finding documentation gaps. This broadens the tool into a package auditor and enables analysis of adjacent repositories or internal assets beyond the declared use case.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest says not to use the skill for directly modifying original documents, establishing a read-only expectation around document handling. The code creates directories and writes rendered output to an arbitrary user-supplied path, which exceeds that declared non-modifying scope even if it does not overwrite the input by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file is entirely written in Chinese and does not indicate that language choice is optional or tied to a documented region-specific requirement. Under the language/locale policy rule, this can be read as a default language constraint without explicit user opt-in.
Content: No source excerpt is available for this finding.