Security audit

Nonprofit Grant Outline

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local nonprofit grant-outline helper with no network, persistence, or destructive behavior, though its bundled script contains inactive generic audit modes that users should understand.

Install only if you want a Chinese-language local helper for drafting nonprofit grant proposal outlines. Run it on files you intentionally provide, prefer --dry-run or stdout when testing, and avoid feeding sensitive beneficiary or budget data unless that is necessary for the draft.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向公益项目资助申请的内容生成工具，核心能力应是围绕目标、预算、影响指标和证据生成 grant proposal 大纲。实际代码并未体现任何与公益项目、grant、预算建模、影响指标映射或证据整合直接相关的专用逻辑。相反，它从 resources/spec.json 读取配置后，按 mode 执行多种通用本地分析任务：structured_brief 只是把输入文本切分整理成通用章节；directory_audit 会递归扫描目录与 Markdown 标题；csv_audit 汇总字段非空率和唯一值；pattern_audit 会用正则扫描 curl|bash、rm -rf、secret/token/private URL 等高风险模式；skill_audit 会检查 Skill 目录中文件完整性和 SKILL.md frontmatter。以上行为的主要用途更接近代码/内容审计与报告生成框架，而非公益 grant proposal 大纲助手。虽然 structured_brief 模式可生成“结构化报告”，但其能力是通用模板化整理，不足以支持声明中的特定业务目的。因此属于明显的描述与行为不一致。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script implements broad filesystem, CSV, regex-based pattern scanning, and skill package auditing behaviors that materially exceed the declared purpose of generating nonprofit grant proposal outlines. This capability mismatch is dangerous because a user invoking a seemingly benign writing skill may unintentionally expose local project contents, metadata, or sensitive text files to inspection and reporting, violating least surprise and least privilege.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The regex scanning for secrets, private URLs, and dangerous shell patterns is unrelated to the advertised nonprofit workflow and causes the tool to inspect arbitrary files and directories for sensitive content. Even without exfiltration code, generating reports that surface matched secrets or internal paths can disclose confidential information to downstream logs, users, or calling systems under a misleading skill identity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L35 的“把预算和影响指标连起来”缺少对公益资助申请、提纲生成等具体上下文的限定，作为触发语过于泛化，可能与普通写作、分析或表格整理请求重叠。README 也未提供负例或排除条件来界定何时不应激活该技能。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope or permissions while its instructions reference local resources, output files, and shell execution via python3. That mismatch weakens containment because an agent may invoke file read/write or shell capabilities without a clearly bounded contract, which is risky even for an otherwise benign content-generation skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation claims the skill is effectively read-only and limited to review/dry-run style output for risky actions, yet it also instructs execution of a local Python script that writes an output file. This contradiction can mislead reviewers and downstream agents about the real side effects, increasing the chance of unsafe execution under a false assumption of non-mutating behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Authorizing shell/exec for a task that only needs to generate a proposal outline expands the attack surface unnecessarily. If an agent is allowed to execute a local Python script based on user-controlled input files or environment state, the skill can be used to perform unintended local actions beyond simple text generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file uses Chinese throughout, including the title and all section content, but does not indicate that the user has opted into Chinese or that the skill is intentionally limited to a Chinese-language audience. The policy requires avoiding forced language constraints unless the user is given a choice or the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report generator emits user-facing headings and guidance such as '结果', '摘要', and '下一步' entirely in Chinese. This enforces a specific language/locale in natural-language output, and the file provides no opt-in, configuration, or justification that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Directory-report output includes fixed Chinese labels such as '扫描报告', '目录概览', and review instructions. Because these strings are presented directly to the user and no language selection mechanism exists, the skill violates the language/locale policy across this output path as well.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: These functions generate user-visible report content entirely in Chinese, including labels, findings summaries, and remediation prompts. The file does not offer a language option or indicate that the tool is intentionally restricted to a Chinese locale, so the language is effectively forced on all users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill_audit functionality inspects package structure and frontmatter for arbitrary skill directories, which is unrelated to grant proposal authoring and expands the skill into a generic repository auditor. In context, this hidden secondary capability increases the chance of unintended local file enumeration and disclosure while undermining user trust about what the skill actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 整个 README 均以中文描述功能、用法和触发示例，但没有说明这是面向特定中文用户群的限定场景，也没有声明可根据用户偏好切换语言。按规则，这可能构成未提供用户语言/locale 选择的自然语言政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This self-check document is entirely Chinese-language content and does not indicate that the skill is region-specific or that users may choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description is written in a mixed Chinese/English style and implicitly sets the skill's language presentation without stating that users can choose their preferred language. Under the policy criteria, forcing or assuming a specific language or locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s title and instructions are entirely in Chinese, which can amount to a language/locale policy issue when the skill does not explicitly state that the user opted into Chinese or that the skill is intended only for a Chinese-language context. There is no visible language-choice or opt-in language anywhere in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title, category label, summary, and input hint are primarily in Chinese, while key task terms such as "grant proposal" remain in English. This may effectively force a mixed-language experience without explicit user opt-in or a documented locale choice, which can conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown template uses Chinese throughout, including the title and all section guidance, but does not indicate that the skill is region-specific or that users may choose another language. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.