Skill Pack Composer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:20 AM UTC
• Version: 1.0.0

Overview

This skill is a local, read-only bundle-report helper with no network, persistence, or hidden system changes, though its actual checks are fairly shallow.

Install only if you want a Chinese-language local report helper for skill bundle directories. Point it at the intended skill or bundle folder, review the generated output before acting on it, and do not rely on it as a complete automated conflict detector without manual review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill's declared purpose is bundle composition and conflict checking, but the finding indicates its actual behavior is materially different and broader, including generic auditing and high-risk pattern scanning while lacking the promised bundle-level checks. Description-behavior mismatches are dangerous because operators may invoke the skill with trust assumptions that do not match what it really does, enabling confused-deputy behavior, overcollection of data, or unsafe workflow decisions based on incomplete checks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation substantially diverges from the declared skill purpose. Instead of composing multiple skills and validating bundle-level conflicts, it performs generic content reporting, directory scanning, CSV inspection, regex-based secret/pattern scanning, and skill auditing, creating a capability mismatch that can cause operators to run a tool on broader local content than expected. In a skill ecosystem, this kind of undeclared behavior is dangerous because users may grant access or trust the tool under false assumptions, leading to unintended analysis of unrelated files and exposure of sensitive content in generated reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README is entirely in Chinese and does not indicate that the skill can adapt to the user's preferred language, which may cause the agent to respond in a fixed language regardless of user context. This is primarily a usability and policy-routing issue, but it can also lead to misunderstandings in security-sensitive review or packaging output if users cannot accurately validate the results.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are quite broad and map to common user requests about combining skills and checking conflicts, which can cause the skill to activate in situations where a more specific or safer skill should handle the task. In an agent routing system, overbroad triggers increase the chance of unintended invocation and scope creep, especially in packaging workflows touching multiple directories and artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all user-facing audit content exclusively in Chinese, including the title and conclusions. Under the policy for natural-language violations, forcing a specific language without user opt-in or documented justification can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable behavior via python3 .../scripts/run.py and implies access to local resources, but it does not declare an explicit tool scope such as allowed tools or permissions. That mismatch can cause an agent runtime to grant broader-than-expected file or shell capabilities, reducing auditability and increasing the chance of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s user-facing description and operating instructions are primarily written in Chinese, with no statement that the user may choose another language or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title, category label, summary, input hint, sections, use cases, examples, and risk text are all written in Chinese, which indicates the skill is designed to operate in a single language. The file does not state that language selection is optional or limited to a justified region-specific context, so this appears to violate the language/locale choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report-generation strings are written only in Chinese, such as headings and guidance text, with no option for the user to choose language or locale. This creates a natural-language policy concern because the skill effectively forces a specific language for its outputs rather than offering an opt-in or configurable locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Directory and CSV report functions emit fixed Chinese headings and guidance text, again without any language-selection mechanism. Because these are user-facing outputs across multiple modes, the locale restriction is systematic rather than incidental.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The pattern scanner searches arbitrary files and emits matching snippets for secrets, private URLs, and shell-danger indicators, even though that functionality is unrelated to composing skill bundles. This expands the skill's effective access to local content and can leak sensitive material into stdout or output files; although the secret pattern partially masks values, other findings such as private URLs or shell snippets are reported verbatim and the masking is not comprehensive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing instructions and acceptance criteria in Chinese only. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file is entirely written in Chinese and does not offer the user any language or locale choice. Under the policy for natural-language violations, forcing a specific language without opt-in can be a compliance issue unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template header and instructions are entirely in Chinese and explicitly present this as the output template, which implies a fixed language choice. Under the language/locale policy, forcing a specific language without offering a user choice or documenting a justified region-specific constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.