Security audit

Implementation Readiness Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, user-directed readiness report generator with no evidence of hidden network access, persistence, credential use, or destructive behavior.

Install only if a Chinese-language implementation-readiness checklist is what you want. Treat the local script as a report generator: provide only project materials you are comfortable processing locally, and review any --output path before running it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a project readiness checker, but the behavior described by analysis indicates much broader auditing features, including directory inspection, regex-based secret or command-pattern scanning, package/frontmatter inspection, and mode switching from external spec.json. That mismatch is dangerous because it can induce users or orchestration systems to invoke the skill in lower-risk contexts while it performs wider filesystem analysis than its metadata suggests, potentially exposing sensitive data or bypassing expected review boundaries.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script dispatches into multiple generic audit modes such as directory, CSV, pattern, and skill auditing, which materially exceeds the declared purpose of an implementation-readiness checker. This broadens the skill into a general filesystem inspection tool, increasing the chance of unintended data enumeration and misuse on unrelated repositories or sensitive local content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples use very broad natural-language phrases such as asking whether a project can start, which are likely to appear in ordinary project discussions. In an agent environment that auto-routes skills from loose matching, this increases the chance of unintended invocation, causing the skill to activate in contexts where users did not explicitly request a readiness gate or structured review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all user-facing content exclusively in Chinese, including headings, audit conclusions, and scoring notes. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable behavior via python3 ... run.py and references reading local resources and producing output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host agent may grant broader file and shell capabilities than users expect, increasing the chance of unintended command execution or file access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire example output is written only in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language context. This creates a natural-language policy concern because it appears to impose a specific language/locale by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title, category label, summary, and input hint are all specified only in Chinese, which indicates a fixed language experience. The file does not offer a language option or document that the skill is intended only for a Chinese-speaking or region-specific context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template content is entirely written in Chinese and provides no indication that other languages are supported or that the user can opt in to Chinese output. This can violate language/locale policy when a skill imposes a specific language by default without user choice or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code generates multiple user-facing report strings in Chinese, such as headings and action prompts, and does so unconditionally. That creates a language-policy issue because the skill forces a specific locale for its outputs without offering the user a language choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The built-in high-risk pattern scanner searches for shell execution, deletion commands, secrets, and private URLs, which is not aligned with a readiness-checking workflow. Even though it only reports matches, it encourages scanning arbitrary files for sensitive indicators and can expose snippets from local content in generated output.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Regex-based detection of secrets and private URLs is unjustified for a readiness checker and can surface sensitive fragments from scanned files into output. The existing redaction is partial and only applied to one pattern, so confidential tokens, internal endpoints, or nearby sensitive context may still be disclosed to stdout or written to disk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill_audit logic checks the completeness and frontmatter of other skills rather than assessing whether a project is ready for implementation. This creates capability drift from the declared skill purpose and enables inspection of other local artifacts that a user may not expect this tool to analyze.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All user-facing instructions and examples in this file are presented in Chinese, and the document does not indicate that the skill supports other languages or that Chinese is an intentional region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file is entirely written in Chinese and does not indicate that language choice is optional or user-selected. Under the policy, a skill should not impose a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.