Security audit

Partner Enable Kit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language partner enablement content generator with no evidence of hidden execution, persistence, networking, or data exfiltration.

Install this only if you want a Chinese-language helper for drafting partner enablement materials. When using the optional script, provide only the intended source file or text and choose an output path you are comfortable writing; avoid feeding sensitive internal policies unless they are already approved for this drafting workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A skill presented as a partner enablement content generator is reported to also perform generic auditing functions such as directory traversal, CSV analysis, regex-based secret scanning, and package compliance inspection. That mismatch is dangerous because it can hide broader data-access and reconnaissance behavior behind an innocuous business description, increasing the chance that users invoke it on sensitive directories or datasets without understanding the real exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's implemented behaviors are materially broader than the declared partner-enablement purpose: it can scan arbitrary directories, inspect repository contents, and generate audit-style reports. This scope mismatch is dangerous because it enables collection and summarization of unrelated local data under a misleading skill identity, increasing the risk of unauthorized data discovery and exfiltration in agent workflows that trust the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all user-facing audit content in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable behavior via python3 and references local resources that imply file reads/writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: a caller or host may permit broader execution than intended, and operators cannot easily verify the minimum required capabilities before invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all user-facing headings and instructions exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown template is written entirely in Chinese and presents the output structure as mandatory, with no indication that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated user-facing report strings are written in Chinese, such as headings and guidance text, with no option for the user to select another language. This is a natural-language locale policy concern because the skill forces a specific language rather than offering opt-in or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Other report functions emit Chinese-language headings and review instructions, again without any mechanism for locale selection. Because this affects multiple output modes, the skill consistently enforces a single language across user-facing responses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The pattern-scanning logic inspects arbitrary files for secrets, private URLs, and shell-command signatures, which is unrelated to generating partner enablement materials. In this context, the capability is risky because it allows the skill to traverse and summarize potentially sensitive repository content that a user may not expect this skill to access, even if it only reports snippets rather than executing them.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill can audit repository structure and parse SKILL.md frontmatter to assess compliance, which is outside the stated partner/channel enablement function. This is dangerous mainly because hidden repo-inspection features expand access to local project metadata and files under a benign-seeming label, undermining least privilege and informed consent in agent execution environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README lists trigger examples such as “为渠道伙伴做一套 enablement 包” and “按伙伴类型拆版本,” but it does not define whether these are the only triggers, what context they apply in, or what similar requests should not invoke the skill. This can make activation scope ambiguous, especially for common partner-support phrasing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file’s natural-language instructions and labels are entirely in Chinese, which indicates a fixed language expectation for the skill output. There is no statement offering the user a language/locale choice or explaining that the skill is intentionally region-specific, so this may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The title, category label, summary, input hint, sections, examples, and risk text are all specified only in Chinese, which indicates a fixed language choice in the skill's natural-language interface. The file does not mention any user language selection or explain that the skill is intentionally region-specific, so this may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all instructions and test expectations exclusively in Chinese. Under the policy for natural-language issues, forcing a specific language without user opt-in or a documented justification is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.