Security audit

Policy Delta Watcher

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local Chinese-language policy change report helper with no evidence of hidden network access, persistence, or destructive behavior.

Install only if you want a Chinese-language helper for drafting policy-change impact reports. Provide specific policy documents or excerpts rather than broad folders or sensitive repositories, and review any generated report before using it for compliance, legal, or operational decisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述聚焦于‘比较新旧制度或政策差异并分析影响’，但代码的实际主功能是一个由 spec 驱动的通用审计/报告生成器。其核心行为包括扫描目录中的文本文件、统计 CSV 字段、匹配危险 shell/secret/private URL 等模式、检查 Skill 文件完整性与 frontmatter，而不是比较两份政策文本、识别制度变更点、或专门输出业务/流程/手册更新差异。虽然 structured_brief 模式会把输入文本整理成报告章节，看起来可用于政策分析场景，但这只是通用模板化分段输出，不包含‘新旧政策比较’所需的差异检测能力。因此代码的主要目的与声明用途存在实质性偏差。

Natural-Language Policy Violations

High

Confidence: 97% confidence
Finding: The metadata includes `do not use for ... 忽略边缘影响人群`, which explicitly normalizes excluding edge-affected or marginalized populations from analysis. In a governance/policy workflow, this can systematically omit impacted groups from change assessments, causing discriminatory outcomes, compliance failures, and unsafe operational decisions.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The built-in regex scanner searches arbitrary files for secrets, internal URLs, and dangerous shell patterns even though the skill is described as a policy-delta watcher. In context, this creates an unjustified repository-scanning capability that can surface sensitive snippets from unrelated files and turn a benign governance tool into a lightweight security reconnaissance utility.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The dispatcher enables multiple generic auditing modes (directory, CSV, pattern, and skill-package auditing) that materially exceed the declared purpose of comparing policy or制度 changes. This broadens the skill into a general local inspection tool that can enumerate files, summarize arbitrary datasets, and scan repositories, increasing the risk of unintended data exposure and misuse in environments where the skill is trusted for a narrow governance workflow.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger examples are generic enough that normal conversation about policy changes could unintentionally invoke this skill in a broader agent system. That can cause misrouting, unintended processing of sensitive policy documents, or use in contexts where users only wanted general discussion rather than structured analysis.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises executable capability via `python3` and references local input/output files and resource files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host agent may permit shell, file read, or file write behavior broader than reviewers expect, reducing least-privilege controls and auditability.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code generates user-facing report content entirely in Chinese, including headings, prompts, and next-step instructions. The file does not offer a language selection mechanism or document that the skill is intentionally region-specific, which creates a natural-language locale policy violation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill can audit other skill packages, inspect required files, and parse SKILL.md frontmatter, which is unrelated to policy-difference analysis. While not inherently exploit code, this scope drift enables metadata harvesting and package inspection of adjacent projects, violating least-privilege expectations for a narrowly scoped policy workflow.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file presents the skill test instructions entirely in Chinese, including the title and all procedural content, without offering a language choice or documenting that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: All visible user-facing instructions, examples, and warnings are presented only in Chinese, and the file does not state that the skill is region-specific or provide any opt-in for language preference. Under the language/locale policy, forcing a single language without user choice or documented justification can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: This markdown file presents all headings and guidance in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The entire template is written as a fixed Chinese-language output format, and there is no visible indication that users may choose another language or locale. This can violate language or locale policy when a skill imposes a specific language without explicit opt-in or documented justification.

Static analysis

No suspicious patterns detected.