Security audit

Sbom Explainer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local SBOM explanation helper with no network, persistence, or hidden execution, though its support script contains dormant audit modes that are broader than the default SBOM workflow.

Install this if you want a Chinese-language, local-only SBOM or dependency-risk report helper. Provide only files you intend it to read, avoid sensitive unredacted SBOM content when possible, and choose --output paths carefully because the script can create directories and overwrite a report file you name.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is narrow SBOM explanation, but the detected behavior appears to support broader directory scanning, data auditing, regex-based high-risk pattern scanning, and externally driven behavior from `spec.json`. This mismatch is dangerous because users and orchestrators may route sensitive inputs to the skill under a low-risk assumption, while the implementation can inspect unrelated files or perform broader analysis than expected.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script supports multiple generic operating modes including directory auditing, CSV auditing, pattern scanning, and skill repository auditing, which go well beyond the declared purpose of explaining SBOMs or dependency risk in non-technical language. This expands the skill into a general analysis tool that can inspect arbitrary local paths and repositories, increasing the chance of unauthorized data exposure or misuse in contexts where users expect a narrowly scoped SBOM explainer.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises shell execution and implied file read/write behavior via `python3 ... --input ... --output ...` but does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens least-privilege controls and makes it harder for a host agent or reviewer to constrain what the skill may access or execute, increasing the chance of unintended file access or command execution.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The report-generation strings are written only in Chinese, such as '结果', '摘要', and the follow-up guidance text. This forces a specific language/locale on users with no opt-in or configuration path, which matches the policy-violation category for language/locale constraints.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: Multiple report functions emit headings and guidance exclusively in Chinese, including scan summaries, field descriptions, and audit messages. Because the script does not offer any language choice or documented locale restriction, it imposes a fixed language across the tool's main outputs.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The built-in regex-based pattern scanner searches arbitrary files for secrets, shell pipelines, and private URLs, which is unrelated to an SBOM explanation skill and effectively turns the tool into a lightweight code/content scanner. In this context, that capability can surface sensitive content from local files and encourages use outside the intended trust boundary, even if it does not execute code.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill_audit functionality checks repository structure and parses SKILL.md frontmatter for arbitrary skill directories, which is unrelated to explaining dependencies or SBOM risk. This unnecessary capability broadens the operational scope of the skill and allows inspection of local repositories that may contain proprietary metadata or internal project structure.

Vague Triggers

Low

Confidence: 77% confidence
Finding: The trigger section uses natural-language examples like “把这份 SBOM 讲成人能看懂的话” and “按影响面排序风险” without defining whether these are the only trigger phrases or giving exclusion conditions. Especially the second phrase is broad enough to overlap with general risk-summary requests outside the SBOM context.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: This code creates parent directories and writes rendered content to a user-specified output path. Although it prints a message after writing, there is no prior disclosure in the CLI help text, comments, or docstring warning users that running without --dry-run will create directories and overwrite/write files.

Static analysis

No suspicious patterns detected.