Security audit

Research Claim Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, read-oriented research-report formatter with some broader dormant audit code, but no evidence of hidden execution, persistence, network access, exfiltration, or destructive behavior.

Install only if you are comfortable with a Chinese-language local helper that reads the input file you point it at and may write an output report where requested. Treat the result as a structured review draft, not a true evidence-verification engine; the dormant audit modes should be documented or removed in a future version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向研究论证质量的能力：核查结论是否被证据支撑、识别证据链断点。实际代码没有任何关于 claims、evidence、citation、argument mapping、source attribution 或结论-证据对应关系的解析逻辑。相反，它读取 resources/spec.json，根据 mode 在 several audit/report 模式之间分派：structured_brief 只是把输入行重组成模板化章节；directory_audit 枚举目录与 Markdown 标题；csv_audit 统计字段非空和唯一值；pattern_audit 用预设正则扫描危险 shell 模式、secret-like 字符串和私有 URL；skill_audit 检查文件完整性与 frontmatter。由此可见，代码的主要用途是通用内容/文件/项目审计与模板化报告生成，和声明中的“研究结论证据支撑检查”存在实质性偏差，且包含多项未声明的审计扫描能力。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s primary behavior is a generic local reporting/audit engine driven by spec modes, not a tool focused on checking whether research claims are supported by evidence. This mismatch is dangerous because users may grant the skill trust and access based on its declared purpose, while it can inspect directories, parse files, and generate unrelated audits, expanding capability beyond user expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 整个 README 仅以中文描述技能能力、用法和风险提示，未说明是否支持其他语言，也未提供用户语言选择或明确的区域性适用限制。按规则，若技能隐含强制特定语言而无用户选择或合理限定，可能构成自然语言策略违规。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L33-L35 给出的触发示例“检查这篇报告的结论是否站得住”“指出证据链断点”是自然语言描述，但没有限定触发上下文、输入条件或排除场景。这类表述可出现在普通讨论或审稿交流中，缺少明确边界，可能导致技能在非预期情境下被路由或调用。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all user-facing audit content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable capability via python3 and references local input/output files, but it does not declare an explicit tool scope such as allowed-tools or permissions boundaries. That creates ambiguity about what the skill is permitted to read, write, or execute, which can lead to over-broad agent behavior and unintended file or shell access in environments that honor skill instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire example output is presented exclusively in Chinese, including the title and all section headings, with no indication that language selection is optional or user-configurable. This can violate language or locale policy when a skill implicitly enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title, category label, summary, examples, and risk text are all written in Chinese, which indicates the skill is intended to operate in a specific language/locale. The file does not mention any user opt-in, alternative language support, or a documented reason that the skill must be Chinese-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written in Chinese and presents a fixed-output structure without any indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple user-facing report strings are emitted only in Chinese, such as headings and guidance text, with no option to select another language. This creates a language policy concern because the skill forces a specific locale without user opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The pattern scanning logic searches arbitrary files for shell-danger and secret-like strings, which is unrelated to validating research claims. In the context of a research-checking skill, this creates an unjustified file-inspection capability that can expose sensitive local content and mislead users about what data the skill will analyze.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill_audit path performs package compliance checks on local skill directories, including frontmatter parsing and existence checks for internal files, which is outside the stated research-claim verification purpose. This broadens the tool into a local repository auditor and increases the risk of unauthorized inspection of developer content under misleading branding.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file is entirely written in Chinese and frames the skill example as operating in that language, without indicating that users may choose another language or locale. Under the policy rule for natural-language constraints, this can be treated as a language preference being imposed without explicit opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.