Security audit

Migration Runbook Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill drafts migration runbooks from local input and I found no hidden network access, persistence, destructive behavior, or external system changes.

Install this if you want a Chinese-language helper for drafting migration runbooks. Treat any migration plans, rollback details, hostnames, or operational data you feed it as local input that may be echoed into the generated report, and use the documented structured_brief flow rather than modifying the script configuration to scan directories.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script implements broad-purpose directory auditing, CSV inspection, pattern scanning, and skill-audit capabilities that go well beyond the stated migration-runbook generation purpose. This expands the skill into a generic local content enumeration and analysis tool, increasing the chance it is used to inspect unrelated repositories or sensitive files and leak their contents into generated reports.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger examples are broad enough to overlap with ordinary user phrasing, which can cause the skill to activate unintentionally in contexts where the user did not explicitly request this runbook generator. In an agent environment, over-broad routing can lead to incorrect skill selection, accidental processing of sensitive migration materials, or bypass of more appropriate review-oriented workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all user-facing audit and skill-evaluation content in Chinese only, and there is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares executable behavior and local file/script interactions but does not constrain tool usage with an explicit permissions or allowed-tools policy. That gap increases the chance that a host agent may grant broader-than-intended file or shell access, especially since the skill instructs use of python3 and references reading/writing input and output files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and role description are written entirely in Chinese and present the skill as operating in that language, with no indication that users may choose another language. This can violate language/locale policy when the skill implicitly constrains output language without documenting choice or opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's safety boundary says it only generates documents and does not directly operate the system, but the work rules explicitly allow executing a local Python script. This contradiction is dangerous because operators or downstream agents may trust the safety statement and permit execution under false assumptions, enabling unintended local actions through the script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown example output presents all headings and instructions in Chinese and does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title, category label, summary, and input hint are written in Chinese, and the file provides no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This creates a natural-language locale constraint that is not documented as optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written in Chinese and presents a fixed-language output structure, with no indication that users can choose another language or opt in to this locale. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated report strings in make_structured_report are written only in Chinese, including headings and user guidance. This forces a specific language on users with no opt-in or configuration mechanism, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: directory_report emits headings and guidance entirely in Chinese, again imposing a fixed locale on all users. Because no opt-in, fallback, or documented region-specific limitation is present in this file, this is a policy-relevant natural-language issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The csv_report and related audit outputs present file summaries and review instructions only in Chinese. This creates a consistent forced-language experience across the tool without any user choice, violating the stated language/locale policy criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The built-in security pattern scanner searches arbitrary files for secrets, internal URLs, and dangerous shell snippets, then emits matching snippets into the report. In the context of a migration runbook generator, this capability is unnecessary and can expose sensitive material from local files while giving the skill an unjustified reconnaissance function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: 该技能说明全文以中文呈现，未见提供用户语言选择、双语支持，或说明该技能仅面向特定中文团队/区域的明确约束。按照语言/locale 政策，若技能隐含固定语言输出而无用户 opt-in，可能构成自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill content is written in Chinese and provides no indication that users may choose another language or that the locale is required for a specific regional or compliance reason. The policy allows locale constraints when they are optional or clearly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all user-facing instructions and acceptance criteria exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without documented opt-in can be considered a locale/language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.