Security audit

Skill Gap Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local skill-suite analyzer that reads user-provided files to produce review reports and does not show hidden persistence, network use, exfiltration, or destructive behavior.

Install only if you are comfortable with a Chinese-language skill that locally reads a user-specified skills directory and may write a report file when asked. Point it at the intended skills root rather than home directories or repositories containing unrelated secrets; review outputs before taking any publishing or configuration action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill’s declared purpose is narrow, but the referenced behavior indicates broader audit functionality, including generic directory inspection, regex-based sensitive-pattern scanning, CSV auditing, and mode-switchable behavior driven by spec.json. This mismatch is dangerous because it can conceal materially different behaviors from users and reviewers, enabling broader data access and analysis than expected and making abuse or accidental overreach harder to detect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README title and all user-facing documentation are written in Chinese, with no indication that other languages are supported or that the language is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale/language issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely written in Chinese, including the title and audit conclusions, with no indication that the skill is region-specific or that other languages are supported. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable capabilities via python3 .../scripts/run.py and implies file input/output behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: downstream systems or users cannot reliably tell what the skill may access or execute, increasing the chance of unintended shell use, file writes, or over-privileged execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description and the main instructional content are written in Chinese and present the skill's behavior in that language without offering any language or locale choice. This can violate language/locale policy when users are not explicitly opted into Chinese or given an alternative.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents the skill output entirely in Chinese, and there is no indication that users can choose another language or opt into this locale. The policy explicitly calls for flagging language or locale constraints when a specific language is forced without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest uses Chinese for the title, category label, summary, input hint, sections, use cases, examples, and risk text, which indicates the skill is presented in a fixed language. There is no visible indication that users can choose another language or that the locale restriction is intentional and documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template, including the title and all section instructions, is written only in Chinese, which implies a fixed language requirement for skill output. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated report strings are fixed Chinese text such as "结果", "摘要", and review instructions, and similar hard-coded Chinese output appears in multiple report builders. This forces a specific language for user-facing output without opt-in or documented locale justification, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: directory_report and csv_report summarize arbitrary directories, Markdown headings, file extensions, and CSV field distributions. These are general-purpose local inspection capabilities and are not directly justified by a skill whose stated purpose is to identify gaps, duplication, and conflicts across a skill suite.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The PATTERNS table and pattern_report function scan arbitrary files for secrets, shell-pipe execution, dangerous rm commands, and private URLs. That capability resembles a lightweight security scanner and is not an obvious requirement for identifying duplicate skills, missing skills, or role conflicts in a skill bundle.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill focused on scanning existing skill suites for duplicates, gaps, responsibility conflicts, and priority vacancies. However, the dispatcher supports unrelated modes such as generic structured brief generation, directory audits, CSV audits, arbitrary pattern scanning, and file-completeness checks, which are broader local analysis capabilities not specific to skill-gap analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire smoke-test file is written in Chinese, and it does not state that the language choice is optional, user-selected, or required for a specific regional/compliance reason. Under the policy, natural-language instructions that impose a specific language without opt-in can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language instructions and labels are entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy expectations when a skill implicitly forces a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.