Security audit

Faq Distiller

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local FAQ-drafting helper that reads user-provided support text and produces a reviewable Markdown draft, with no evidence of hidden networking, persistence, or destructive behavior.

Install this only for local, reviewable FAQ drafting from support records you intentionally provide. Redact personal, customer, credential, or regulated data before use, and be aware that the bundled script contains unused generic audit helpers even though the packaged configuration runs the FAQ mode.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个面向客服/知识库场景的 FAQ 提炼工具，核心能力应是从对话或工单内容中归纳问题答案并按用户阶段分类。但代码实际是一个由 resources/spec.json 驱动的通用报告生成器/审计器。其显式支持的模式包括 directory_audit、csv_audit、pattern_audit、skill_audit 和 structured_brief；其中 pattern_audit 还会扫描高风险命令、疑似 secrets、私有 URL 等安全相关模式，skill_audit 会检查技能目录文件完整性和 SKILL.md frontmatter。虽然 structured_brief 可把输入文本分配到若干 section，表面上可用于某些总结任务，但代码中没有任何针对 FAQ 提炼、问答抽取、用户阶段识别、客服语料理解的专门逻辑。实际主要用途明显比声明更偏向通用审计/检查，属于 materially different primary purpose，并包含多项未声明能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script contains a generic security-pattern scanner that reads arbitrary files and reports matched snippets, including partial secret-like values and private/internal URLs. In a FAQ/support skill, this capability is unjustified and dangerous because it can be repurposed to inspect unrelated local data and surface sensitive content under the guise of a harmless knowledge workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The dispatcher enables multiple generic audit modes based on an external spec, including directory, CSV, pattern, and skill auditing, which materially exceeds the declared FAQ-distillation purpose. In this skill context, that mismatch increases risk because a user may grant broader filesystem inputs expecting support-content processing, while the code instead enumerates and analyzes arbitrary local content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger examples are quite broad and do not clearly state when the skill should not be used beyond a few general notes elsewhere in the README. In agentic environments, vague activation phrases can cause the skill to be selected for overly broad support data processing, increasing the chance of handling sensitive tickets, chats, or records without sufficient scoping or privacy review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly permits shell execution via python3 "{baseDir}/scripts/run.py" and implies file input/output, but it declares no corresponding tool scope such as permissions or allowed-tools. This creates an authorization gap where reviewers and runtime policy may not accurately understand or constrain the skill's capabilities, increasing the chance of unintended file access or command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill title, section headings, behavioral instructions, and manifest description are written as if the skill operates in Chinese by default, with no indication that users may choose another language. This creates a language/locale policy issue because the skill appears to impose a specific language without opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template headings and instructions are entirely in Chinese, which implies the skill output is expected in a specific language. The file does not offer a language choice or explain a region-specific justification, which can violate a language/locale policy requiring user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report-generation strings are hard-coded in Chinese, including headings, summaries, and next-step instructions. This enforces a specific language for user-facing output without offering a language choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code audits arbitrary skill-package completeness and parses SKILL.md frontmatter, which is unrelated to extracting FAQs from support conversations. While not directly executing code, it broadens the skill into a repository-inspection tool and can reveal project structure and metadata from local directories the user did not intend to expose for this purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI presents itself as a local support script but accepts arbitrary paths, can analyze directories/files unrelated to customer conversations, and can write reports to attacker-chosen output locations. In the context of a mis-scoped skill, this increases the chance of unintended local data processing and persistence of sensitive derived output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This self-check document is entirely Chinese-language, and the file does not indicate that the language choice is optional, user-selected, or required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content throughout the file is presented entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy check, forcing a specific language without user opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all headings and instructional text in Chinese, but does not state that the language is optional or user-selected. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire smoke-test document is written in Chinese, including the title, steps, and pass criteria, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy for natural-language content requires either user opt-in or a clearly documented and justified locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.