Security audit

File Drop Organizer

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only local directory organization helper with some rough edges, but I did not find hidden execution, persistence, network access, or destructive behavior.

Install this if you want a Chinese-language helper that summarizes a local directory and drafts an organization plan. Review the chosen input path before running it, because directory names and some Markdown headings may be included in the report; use --output only for a report path you intend to create or overwrite.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A declared file-organizing skill that actually behaves like a generic report generator, scanner, or auditor is a serious trust-boundary problem because users may invoke it expecting low-risk organization help while it performs unrelated analysis or broader processing. This mismatch increases the chance of unauthorized file inspection, unexpected command execution, or stealthy dual-use behavior hidden behind a benign description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for organizing download or temporary-material directories by proposing categorization, naming suggestions, and move plans before any execution. However, the implemented modes are generic structured briefs, directory/content audits, CSV summaries, pattern/security scanning, and skill manifest checks; there is no logic for classifying files into destination groups, proposing renames, or planning file moves.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L35 的“给我移动预案”缺少明确领域约束，没有限定必须是目录整理、下载文件夹或文件归档场景。与上文相比，这个触发语更像通用请求，容易和其他规划、迁移、搬运类日常表达发生重叠。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises read-only, dry-run organization behavior, but it also declares executable capability via python3 and appears able to read and write files without any explicit permissions or allowed-tools scoping. In an agent environment, this broad undeclared capability weakens containment and can let the skill perform filesystem changes or shell-driven actions beyond what a user would reasonably expect from the metadata.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The markdown content, including headings and instructions, is entirely in Chinese and does not indicate that the user can choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title, category label, and summary are presented only in Chinese, which indicates a fixed language/locale for the skill's natural-language interface. The file does not offer any user language choice or explain that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated report strings in this function are fixed in Chinese, which imposes a specific language on users regardless of their preferences. This is a natural-language policy concern because the skill does not offer any language choice or document a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This report path emits headings and guidance entirely in Chinese, reinforcing a fixed-language behavior across the skill. Because no opt-in, locale flag, or documented regional constraint is present, this violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CSV report builder uses Chinese-only headings and explanatory text, again forcing one locale for user-facing output. There is no indication that users can choose a language or that the limitation is intentional and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pattern_audit mode scans files for shell-danger patterns, secrets, and private URLs, which is a security/code-auditing capability rather than a file-drop organizer function. This capability is not justified by the manifest's stated purpose of organizing files and planning renames/moves in download or temporary directories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The pattern-scan report text is emitted only in Chinese, which creates a consistent forced-locale behavior in another execution path. Without user choice or documented justification, this is a policy violation under the language/locale rule.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The parse_frontmatter and skill_audit logic inspects SKILL.md, README.md, SELF_CHECK.md, resources, and tests to validate another skill package's structure and metadata. Auditing AI skill package completeness is not an obvious or necessary capability for organizing downloaded files or temporary materials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Error messages and audit section text in the skill-audit flow are written only in Chinese. Since the script's CLI does not present any locale preference or region-specific justification, this constitutes a forced language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file is natural-language content, and it presents all user-facing audit information exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or justification can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The description and body content are primarily in Chinese, while some operational terms and routing examples are in English. This may impose a language/locale expectation on users without explicitly offering a language choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents the skill entirely in Chinese, including the title, goals, and requirements, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy requires flagging language or locale constraints when they are imposed without user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template title is written in Chinese, and all section headings and instructions in the file are exclusively in Chinese. This indicates a fixed language/locale expectation without offering the user a choice or documenting why a Chinese-only output is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire smoke test document is written in Chinese, with no indication that language choice is optional or constrained to a justified locale-specific context. This can violate a language/locale policy when users or maintainers are not given a choice or notice about the enforced language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.