Security audit

Insight Brief Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly acts like a local insight-brief generator, but its bundled script also contains under-disclosed directory, pattern, CSV, and skill-audit modes that exceed the stated briefing purpose.

Install only if you are comfortable with a local Python helper that can read user-provided files and write requested reports. Treat it as Review-worthy because the script contains extra local audit/scanning modes that are not clearly explained in the main skill description; avoid pointing it at broad private directories or sensitive repositories unless you have reviewed and constrained the script/spec behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A strong description-behavior mismatch is a real security concern because the skill presents itself as a narrow briefing generator while static analysis indicates broader audit/scanning behavior driven by external `spec.json`. That hidden general-purpose analysis capability could be used to enumerate files, inspect unrelated content, or scan for sensitive data under the cover of an innocuous analytics workflow.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code implements built-in regex-based security scanning for secrets, private URLs, and dangerous shell patterns across arbitrary files. In a skill presented as an analytics/briefing helper, this creates a hidden reconnaissance capability that can enumerate sensitive content from local repositories and repackage it into output reports.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script dispatches into multiple unrelated modes including directory auditing, CSV auditing, pattern scanning, and skill auditing, which substantially exceeds the declared purpose of generating management-readable insight briefs. This capability expansion enables arbitrary local file and directory inspection, increasing the chance of unintended data exposure and misuse under a misleading skill description.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: README 标题及全文以中文呈现，体现出该技能默认面向中文使用场景，但文档中未说明是否支持其他语言或允许用户选择输出语言。按规则，若技能对语言/locale 有默认强约束而无用户 opt-in，属于自然语言政策风险。

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger examples are broad natural-language phrases that could overlap with ordinary user requests, increasing the chance this skill activates when the user did not explicitly intend to invoke it. In a briefing/analytics skill, misrouting can cause unintended processing of sensitive business data or produce misleading summaries in the wrong workflow context.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable capability via `python3` and references reading templates/specs and writing output files, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host may permit broader file and shell access than users expect, increasing the chance of unintended file access or command execution.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The manifest description is written in a mix of Chinese and English, and the rest of the skill instructions are predominantly in Chinese. This can impose a language preference on users without explicit opt-in or offering an alternative locale, which matches the language/locale policy concern.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The entire example output is presented exclusively in Chinese, including the title and all section headings, with no indication that language selection is optional or user-configurable. This can violate language/locale policy because it implicitly constrains the skill's output language without documented opt-in or region-specific justification.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The title, category label, summary, input hint, sections, examples, and risk text are all specified only in Chinese, which indicates a fixed language/locale presentation. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which is present here.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown template forces Chinese-language output throughout the file, including the title and all section headings, with no indication that users can choose another language. That creates a natural-language policy concern because the skill appears to impose a specific language without explicit user opt-in or a documented region-specific justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The generated report strings are written in Chinese (for example, '结果', '摘要', '待确认项', and '下一步') with no visible option for the user to choose locale. This creates a natural-language policy concern because the skill effectively forces a specific language rather than allowing user selection or documenting a justified locale restriction.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script audits arbitrary skill directories, inventories files, parses SKILL.md frontmatter, and validates metadata unrelated to the stated insight-briefing purpose. This broad local inspection capability can expose internal project structure and metadata, making the skill more dangerous because its description would not lead users to expect repository or skill-package auditing.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The entire smoke test is written only in Chinese, including the title, procedure, and acceptance criteria, with no indication that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy for natural-language violations, a skill that forces a specific language without user opt-in can be noncompliant.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The file’s user-facing instructions and labels are entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a policy issue.

Static analysis

No suspicious patterns detected.