Back to skill

Security audit

Real Estate Showing Brief

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language real-estate showing brief generator with no network, persistence, or automatic high-risk actions, though it includes unused generic audit code that should be treated cautiously.

Install only if you want a Chinese-language local helper for real-estate showing briefs. Provide only the buyer, listing, and schedule materials needed for the brief, and avoid using broad project directories or sensitive unrelated files as input. The publisher should remove or document the inactive generic audit modes in a future version for cleaner scoping.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
声明描述的是一个面向房地产带看前准备的业务型工作流工具,应围绕买家画像、关注点、带看路线和现场提问清单组织内容。实际代码却是一个通用 CLI 审计/报告生成器,其行为由 resources/spec.json 决定,可对目录、CSV、代码/文本模式及 Skill 结构进行扫描和检查。代码中没有任何与房产、买家画像、看房路线、现场提问清单、房源信息整理等领域逻辑直接相关的实现。相反,它包含明显独立且未声明的能力,如文件系统遍历、模式安全扫描和 Skill 合规检查。这表明其主要用途与声明严重不一致,因此应判定为描述与行为不匹配。

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The pattern scanning feature reads arbitrary files/directories and searches for secrets, private URLs, and shell-execution patterns. In a real-estate briefing skill, this is unjustified capability expansion that can be repurposed to inspect sensitive local content and surface security-relevant data from unrelated files.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill-package compliance audit inspects arbitrary directories for specific files and parses SKILL.md frontmatter, effectively acting as a generic package auditing tool. This behavior is outside the declared real-estate domain and increases the risk of deceptive capability packaging, where a seemingly benign skill can probe unrelated local repositories.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The dispatcher exposes multiple generic modes such as directory, CSV, pattern, and skill auditing that are unrelated to the declared real-estate showing brief purpose. This broadens the skill into a general local file inspection tool, increasing the chance of unauthorized workspace enumeration and misuse in contexts where users would expect only brief-generation behavior.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation examples "帮我做一份带看前简报" and especially "按买家需求整理关注点" are natural, everyday phrases without clear routing constraints or exclusion conditions. The README does not specify when these phrases should invoke this skill versus a more general summarization or planning skill, which increases the chance of unintended activation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises local execution via `python3` and references reading templates/specs and writing outputs, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where a host agent may grant broader shell or filesystem access than users expect, increasing the chance of unintended file access or command execution through prompt-controlled inputs.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The entire example output is presented exclusively in Chinese, including the title and all section headings, with no indication that the user can choose another language or that the skill is restricted to a Chinese-language context. This creates a natural-language policy concern because it appears to impose a specific language/locale by default.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
This code generates user-facing report text entirely in Chinese, including headings, prompts, and next-step instructions. Because the file provides no opt-in, language selection, or justification for a Chinese-only locale, it creates a natural-language policy violation under the language/locale rule.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The directory audit path recursively enumerates arbitrary text files and extracts Markdown headings from the target directory. While not directly exfiltrating data over the network, it enables broad inspection of local project contents that are unrelated to the stated showing-brief use case, creating unnecessary exposure of sensitive filenames and document content.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The directory and CSV report generators produce visible output strings in Chinese only, such as section labels and audit guidance. This reinforces that the skill forces a specific language across multiple modes rather than offering a user choice or documenting a justified regional scope.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
These functions generate more user-visible headings, findings labels, and remediation guidance entirely in Chinese. Across the script, the repeated hard-coded locale indicates a policy-level language restriction rather than an incidental string, and no opt-in or scope limitation is present in this file.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The markdown template is entirely written in Chinese and presents the output structure as fixed, which can impose a specific language on users without any stated option to select another locale. The policy allows language constraints only when user choice or a justified locale limitation is documented, which is not present here.

Static analysis

No suspicious patterns detected.