Security audit

Priority Conflict Resolver

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local priority-planning helper, but it ships extra dormant audit code that users should be aware of before running its script.

Install only if a Chinese-language priority-planning helper is what you want. If you run scripts/run.py, provide only the input files you intend it to read and choose output paths carefully; review any future changes to resources/spec.json because changing its mode could activate broader local audit behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a decision-support/planning tool for prioritization and tradeoff analysis. However, the code is a general local auditing/reporting script whose behavior depends on spec.json mode. Its implemented capabilities center on reading files/directories, enumerating text files, sampling headings, analyzing tabular fields, regex-scanning for dangerous patterns/secrets/URLs, and checking Skill repository completeness and frontmatter validity. While one mode ('structured_brief') could loosely produce a structured planning-style report from text, the overall primary purpose of the code is broader and materially different: filesystem/content auditing rather than priority/tradeoff planning. No special permissions are declared, and the code stays local, but the undeclared auditing and scanning capabilities are significant enough to constitute a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The built-in pattern scanner searches arbitrary files for secrets, private URLs, and shell snippets, even though the skill is presented as a planning/resolution assistant. In context, that is a covert auditing capability that can surface sensitive credentials and internal infrastructure references from user-supplied paths without clear expectation or consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill manifest describes a priority/tradeoff planning tool, but the executable supports directory auditing, CSV auditing, pattern scanning, and skill-package inspection. This capability mismatch is dangerous because it enables filesystem inspection and content analysis outside the user-expected scope, which can expose sensitive local data and violate least-privilege assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file presents all user-facing instructions, examples, and warnings exclusively in Chinese, but does not state that the skill is intended only for Chinese-speaking users or provide an opt-in language choice. Under the language/locale policy, forcing a specific language without user choice or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are generic enough that ordinary planning requests could invoke this skill unintentionally, causing it to take over workflows outside the user's explicit intent. In an agent environment, over-broad routing can lead to misapplication of the skill's framing, including producing authoritative-seeming prioritization outputs in contexts where a narrower or safer tool should be used.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable shell usage and implies reading/writing local files via input/output paths, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization and review gap: a caller or runtime may permit broader capabilities than intended, making it harder to constrain or audit file and shell access safely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file is entirely written in Chinese and does not offer any language or locale choice to the user. Under the policy for natural-language violations, a fixed language can be a violation when there is no opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire example output is presented only in Chinese, and there is no indication that language choice is optional or limited to a China-specific use case. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template is entirely written in Chinese and directs output structure in Chinese without indicating that the language is configurable or tied to an explicit user preference. This can cause unintended language forcing, reducing usability, creating misunderstanding, and potentially leading users to act on output they cannot fully verify; however, it does not introduce direct code execution or data exfiltration risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file generates multiple user-facing report sections and messages entirely in Chinese, such as headings, summaries, and next-step instructions. The skill does not offer any user opt-in or locale selection, which is a natural-language policy violation under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The directory, CSV, and pattern audit report builders all emit Chinese headings and guidance text directly to users. Because the file forces a specific language across these modes without user choice or a documented regional constraint, it violates the language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Frontmatter validation errors, audit section labels, and fallback messages in the skill audit path are presented only in Chinese. This imposes a language choice on users across another major execution path without offering an alternative or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill can audit repository structure and inspect package files such as SKILL.md, README.md, and related resources, which is unrelated to resolving competing priorities. This expands the attack surface by enabling enumeration of local project contents and metadata that users would not reasonably expect to expose to a planning workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses Chinese throughout, including headings, audit conclusions, and evaluation criteria, but does not indicate that the skill is region-specific or provide any user opt-in for language preference. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents all instructions and acceptance criteria only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.