Security audit

Evidence Gap Mapper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local evidence-gap review helper with some dormant audit code, but the packaged configuration only runs the stated report-structuring workflow.

Install this if you want a Chinese-language local helper for reviewing reports or presentations for weak evidence. Review inputs before use because the script can read the file you point it at and can write a report file; avoid giving it sensitive material unless that is intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A mismatch between the declared purpose and the observed capabilities is security-relevant because it can conceal broader data access and analysis behavior than users expect. If the underlying implementation performs directory auditing, file enumeration, secret-pattern scanning, or dynamic mode switching based on spec.json, the skill could be invoked under the guise of evidence-gap analysis while actually inspecting unrelated project content or sensitive files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script supports multiple modes such as directory auditing, CSV auditing, pattern scanning, and skill repository auditing that materially exceed the declared purpose of mapping evidence gaps in reports or presentations. This capability expansion increases the chance the skill is repurposed to inspect arbitrary local content, broadening data exposure and violating least-functionality expectations for users invoking a narrowly described skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger example "给我一个补证优先级" is broad enough to match ordinary analysis or prioritization requests outside the narrow evidence-gap use case. In skill-routing systems, overly generic triggers can cause the skill to activate on unrelated user prompts, leading to inappropriate handling of content and reducing routing safety and predictability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises shell execution and file output behavior via python3 ... --output <输出文件> and references local resources, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity: a caller or platform may permit broader file and shell access than the skill actually needs, increasing the chance of unintended reads, writes, or command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file presents the skill primarily in Chinese and does not state that users may interact in other languages or choose their preferred locale. Under the policy, forced language behavior without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire example output is written in Chinese and presents a fixed Chinese-language response format, with no indication that users can choose another language or opt in to this locale. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title, category label, summary, and input hint are presented only in Chinese, indicating a language-specific skill experience without any stated opt-in or justification. The policy requires either user language choice or a clearly documented locale-specific constraint, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template headings and instructions are entirely in Chinese, which imposes a specific language on outputs. The file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated report strings are written in Chinese throughout the report-building logic, which imposes a specific language on all users. The file does not offer any language choice, opt-in, or documentation that this is a region-specific tool, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The built-in regex scanning for secrets, private URLs, and shell-dangerous patterns is unrelated to evidence-gap mapping and enables inspection of arbitrary files for sensitive content. Even without exfiltration, this creates an unexpected local discovery capability that can surface credentials or internal paths in output, making the skill more dangerous in the context of a benign-seeming research workflow tool.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill repository compliance auditing workflow is unrelated to the declared evidence-gap mapping purpose and allows structured inspection of a broader directory tree and metadata files. That mismatch is dangerous because it hides repository enumeration and content analysis behind a misleading skill description, increasing the risk of unauthorized review of local project contents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The natural-language documentation appears to require Chinese throughout the skill description and examples, with no indication that users may choose another language or locale. This can violate a language/locale choice policy when no opt-in or justified region-specific constraint is documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is natural-language content, and it appears to require Chinese comprehension throughout the document. The policy allows locale-specific behavior only when user choice or a justified locale constraint is documented, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file title and all instructions are written in Chinese, and there is no indication that language selection is optional or region-specific. Under the policy rule, a skill that effectively constrains language/locale without opt-in or documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The script creates parent directories and writes report content to the specified output path, which is a filesystem-modifying action. While it prints after writing, there is no pre-write warning, confirmation, or explanatory comment/docstring in this file about the file-creation behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.