Security audit

Permission Footprint Reviewer

Security checks for vulnerabilities and agentic risk

Overview

This is a local permission-review helper that is coherent with its stated purpose, with some unused broader audit code and Chinese-only documentation to consider.

Install only if you want a Chinese-language local helper for permission-footprint reviews. Run it on explicit, non-sensitive inputs where possible, and be aware that the script contains additional inactive audit helpers that should be documented or removed if not intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is narrowly framed as permission-footprint review, but the detected behavior suggests broader auditing functions including directory enumeration, file sampling, regex-based scanning, and project compliance checks. This mismatch is dangerous because users and policy engines may grant trust or permissions based on the benign description while the skill can operate on a much wider set of local content and workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s main dispatch logic supports multiple generic analysis modes such as directory auditing, CSV auditing, pattern scanning, and skill structure checks, which goes well beyond the declared purpose of reviewing permission requirements and least-privilege alternatives. This capability expansion increases the skill’s data-access footprint and makes it usable for broader repo/content reconnaissance, creating a mismatch between stated intent and actual behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 标题及全文均以中文表述，技能名称“权限足迹审查员”暗示该技能面向中文使用场景，但文档中未说明是否支持其他语言，也未给出用户选择语言/locale 的方式。按组织语言/locale policy，这可能构成未获用户同意的语言约束。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L33-L35 的触发示例仅给出“审查这个脚本需要哪些权限”“给我最小权限方案”这类自然语言短语，缺少更明确的触发范围、限定条件或排除示例。尤其“给我最小权限方案”较为泛化，可能在与权限审查无关的普通对话中也被匹配。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all user-facing content exclusively in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language is offered. The file does not indicate that the skill is intentionally limited to a Chinese-speaking audience or region-specific use case.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable capabilities via python3 .../scripts/run.py and references reading templates/specs and writing output files, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates a permission ambiguity gap where a host or reviewer cannot easily enforce least privilege, increasing the chance of unintended file access or shell execution beyond the skill's stated audit role.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all user-facing instructions and headings in Chinese, and there is no indication that the skill offers language selection or that it is intentionally limited to a Chinese-speaking context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title, category label, summary, and input hint are all presented only in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy requirements when a skill implicitly enforces one language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template title is entirely in Chinese, which indicates the skill output is expected in a specific language. The file does not mention any user language preference, opt-in, or alternative locale handling, so it appears to impose a language choice unconditionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code generates user-facing report content entirely in Chinese, including headings, prompts, and next-step guidance. That enforces a specific language/locale without opt-in, which matches the policy category for language or locale violations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The directory and CSV audit paths allow the skill to inspect arbitrary local content and summarize it, which exceeds what is obviously needed to review permissions and least-privilege alternatives. Even though the code is read-only, this broadens accessible data and can leak structure or metadata from unrelated files into generated reports.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The built-in regex scanner looks for secrets, internal URLs, and risky shell patterns across arbitrary files, which is not clearly necessary for a permission-footprint reviewer. In this skill context, that broad content-inspection behavior can expose sensitive material during normal use and repurpose the tool into a lightweight secret/recon scanner.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is written entirely in Chinese and provides no indication that the language choice is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description includes both Chinese and English phrasing, and the skill body is written entirely in Chinese, but nowhere does it offer the user a language preference or opt-in. Under the language/locale policy rule, forcing or assuming a language without explicit user choice can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's headings and instructions are all in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.