Security audit

sop-factory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SOP-drafting helper with a small local script and no evidence of hidden networking, persistence, credential use, or destructive behavior.

Installers should understand that this skill helps draft SOP documents and includes a local Python helper that writes an outline file. Use an explicit output path when running the script, and review generated SOP drafts before using them as official procedures.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger examples are broad natural-language phrases such as '做 SOP', '流程文档化', and '交接文档' that can match many ordinary user requests outside a narrowly scoped SOP-conversion task. In an agent-skill ecosystem, overly broad activation increases the chance of accidental invocation, context capture, or unintended workflow suggestions, which can lead to inappropriate file handling or premature automation even without malicious code.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: This markdown file is entirely written in Chinese and presents the checklist and conclusion as the required operating language, with no indication that users may choose another language or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill references a local helper script and the analyzer detected file_write capability, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: the runtime may permit write actions without clear user-facing constraints, making unintended or excessive file modification easier if the script is invoked.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase at line 5 is broad enough to match common user language outside a clearly scoped SOP-generation request. This can cause unintended activation of the skill, leading to prompt/route confusion or accidental use in contexts where the user did not explicitly request this capability.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The listed phrases are ambiguous and lack scope constraints, especially terms that can appear in ordinary conversation or many unrelated productivity tasks. In an agent environment, this increases the chance of mis-triggering the skill and applying its workflow to requests that were not intended for SOP formalization.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The file presents core usage sections in Chinese while key behavior and examples are partly in English, but it does not state whether the skill should respond in the user's language or offer a language choice. This can create an implicit language policy without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The skill includes multiple Chinese trigger phrases alongside English ones, but the document does not explain whether language selection is optional, user-driven, or scoped to a Chinese-language environment. Under the policy rule, language constraints should be explicitly optional or justified to avoid implied locale-specific behavior.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown file presents all operational instructions in Chinese, including objectives, checks, and pass criteria, with no indication that the user can choose another language. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in.

Static analysis

No suspicious patterns detected.