Security audit

Skill Readme Rebuilder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local documentation/report helper; its extra audit code and Chinese-only output deserve notice, but the artifacts do not show hidden exfiltration or harmful behavior.

Install only if you are comfortable with a Chinese-language local helper that samples files from the skill directory you provide. Use it on intended skill folders, avoid broad private directories, and review generated reports before using --output to write files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose is documentation rebuilding, but the analyzed behavior reportedly includes directory auditing, file sampling, data analysis, and security-pattern scanning that are not disclosed in the description. This mismatch is dangerous because operators may invoke the skill expecting narrow doc-generation behavior while it performs broader inspection activities, which can expose sensitive repository contents or expand the effective trust boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples are broad enough to match routine documentation requests such as rebuilding a README or adding FAQ/examples, which can cause the skill to activate outside a narrowly scoped, explicitly consented workflow. In an agent environment, this increases the chance of unintended invocation on arbitrary directories or repos, potentially exposing local content for analysis and producing misleading documentation from incomplete inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents the skill self-check and audit conclusion solely in Chinese text, which can impose a language constraint on users without opt-in. The policy for this category requires flagging language or locale restrictions unless the skill offers a choice or clearly justifies the constraint.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly references shell execution and implies file input/output behavior, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a caller or platform may not understand that the skill can read files, write outputs, or invoke a local script, increasing the risk of unintended command execution or file access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown content is entirely in Chinese and presents the skill's instructions and outputs in a fixed language, without offering any user opt-in or alternative locale choice. Under the policy, forcing a specific language without user choice or clear region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README example output is entirely written in Chinese, including the title and all section headings, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking context. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest presents the skill entirely in Chinese in multiple user-facing fields, but does not indicate that the skill is region-specific or that users can opt into a preferred language. That creates a natural-language policy concern because the skill appears to enforce a specific language/locale by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated report strings in make_structured_report are hard-coded in Chinese, which imposes a specific language on users. The file provides no option to choose locale or output language, so this is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: directory_report and csv_report emit headings and guidance entirely in Chinese, continuing the same forced-locale behavior across multiple output paths. Because the script does not expose any locale setting or opt-in, users are not given a choice of language.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a documentation-rebuilding skill focused on deriving README, FAQ, and examples from SKILL.md, scripts, and resources while keeping documentation consistent. However, this code includes standalone high-risk pattern scanning and generic audit/report modes over arbitrary files and directories, which are materially broader than documentation regeneration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The PATTERNS table and pattern_report function search arbitrary content for secrets, private URLs, and destructive shell patterns like curl-pipe-bash and rm -rf. That is a security-audit capability, not an obvious implementation detail of reconstructing README/FAQ/examples from skill materials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The pattern_report, parse_frontmatter error messages, and skill_audit sections all return Chinese-language content by default. This enforces a specific language across the tool's user-facing messages without documented user choice or justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire smoke-test document is written in Chinese, including headings, instructions, and expected outputs, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-language context. Under the policy rule for natural-language violations, this is a language/locale constraint that lacks user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The entire skill README is presented only in Chinese and does not indicate whether users may interact in other languages or whether the skill is intentionally limited to a Chinese-language context. Under the stated policy, forcing a specific language without opt-in or documented justification can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description string is written in a mixed Chinese/English form and does not indicate whether the user can choose their preferred language. Under the policy, forcing or assuming a language/locale without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template headings and instructions are entirely in Chinese, including the title '输出模板', which implies a fixed language/locale for generated content. There is no natural-language indication that users may choose another language or that the Chinese-only format is required for a justified region-specific purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.