Security audit

Skill Smoke Test Author

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language smoke-test template helper with a small Python script and no evidence of hidden network access, persistence, or destructive behavior.

Install this if you want a Chinese-language local helper for drafting Skill smoke-test templates. Review its output before using it, avoid sending sensitive input unless needed, and be aware that the Python script contains unused broader audit/report modes even though the shipped configuration uses the smoke-test template mode.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill generates smoke test templates for Skills, specifically around dependency-missing, empty-input, and standard-path test cases. The supplied code does not generate test templates or tests at all. Instead, it loads a spec and produces various kinds of audit/report outputs based on mode: structured summaries, directory audits, CSV audits, pattern/risk scans, and Skill structure checks. It reads files and directories, scans contents with regexes, parses frontmatter, and can write reports to output files. While one mode ('skill_audit') is loosely related to Skills, the primary behavior is auditing/reporting rather than smoke-test template generation. Therefore the implementation materially differs from the declared purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says this skill automatically generates smoke test templates covering dependency absence, empty input, and standard paths. However, the code implements multiple unrelated report modes such as directory auditing, CSV summarization, regex-based pattern scanning, and skill repository compliance checks, which are broader analysis capabilities rather than smoke-test template generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language content is entirely in Chinese, including the skill name and usage instructions, with no indication that users may choose another language or locale. This can violate language or locale policy when a skill implicitly enforces a single language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable behavior via python3 .../scripts/run.py and references reading local resources and producing output files, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host may permit broader file or shell access than users expect, increasing the risk of unintended file reads/writes or command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and the full skill instructions are written in Chinese and present the skill behavior as operating in that language by default, without offering the user a language or locale choice. This can violate a language/locale policy when users have not explicitly opted into Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template is written entirely in Chinese and frames the expected output structure in Chinese without any indication that language should follow user preference or explicit opt-in. In a multilingual agent environment, this can cause the skill to override user language expectations, reduce usability, and lead to incorrect or inaccessible outputs for users who do not read Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code generates multiple user-facing report headings and guidance strings only in Chinese, such as "结果", "待确认项", and workflow instructions. That enforces a specific language/locale on all users without any opt-in, choice, or justification, which matches the policy-violation category for language or locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The directory and CSV report functions produce headings and review guidance exclusively in Chinese, including labels like "扫描报告", "目录概览", "字段概览", and section prompts. Because these are user-visible outputs with no locale opt-in or documented regional limitation, they represent the same language-policy issue across other execution paths.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The built-in PATTERNS and pattern_report functionality scan files for secrets, private URLs, and dangerous shell snippets. That is a security auditing capability, which is not an obvious or declared requirement for generating smoke test templates for skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These functions continue the same behavior by emitting findings summaries, audit labels, and repair guidance solely in Chinese. Since the script accepts general CLI input but does not offer any language choice, it imposes a locale requirement without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The parse_frontmatter and skill_audit functions validate repository files, frontmatter fields, and metadata JSON. This is a compliance/linting capability for skill packages, not an obvious requirement for authoring smoke-test templates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown content is entirely written in Chinese and specifies expected output section names in Chinese, but it does not state that the skill is region-specific or that users may choose another language. Under the policy, a language or locale constraint should be justified or offered as an opt-in choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The README lists example triggers such as '为这个 skill 写一份 smoke test' and '覆盖依赖缺失和空输入', but it does not clearly define whether these are the only invocation phrases, what context must be present, or when the skill should not activate. Without negative examples or explicit scope constraints, similar everyday requests about testing could unintentionally match this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The heading is entirely in Chinese ("Skill 冒烟测试作者自检"), which indicates a fixed language choice in the skill-facing content. The file does not offer any language choice or document a justified locale restriction, so this is a natural-language locale policy concern under the stated rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file’s user-facing natural-language content is entirely in Chinese, and there is no indication that the skill offers users a language/locale option or that the restriction is required for a region-specific purpose. This may violate a language/locale policy that requires user choice or explicit justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.