Security audit

Survey Response Coder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language survey-response reporting helper with no network, persistence, or destructive behavior, though its shipped script contains unused audit modes that are broader than the advertised workflow.

Install only if you want a Chinese-language local helper for survey-response summaries, and give it only the survey files you intend to analyze. The inactive audit code should be removed or documented in a future version, but I did not find evidence of exfiltration, persistence, destructive actions, remote code loading, or hidden automatic execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a specialized tool for coding open-ended survey answers into themes, emotions, and tags, plus producing a reviewable coding manual. The supplied code instead implements a multi-mode generic auditing/reporting script controlled by resources/spec.json. Its capabilities include scanning directories, counting file extensions, extracting markdown headings, profiling CSV fields, regex-based detection of risky command/secret patterns, and validating a skill folder structure. While it can generate structured reports, there is no logic for NLP, sentiment/emotion detection, thematic coding, respondent-answer labeling, or creation of a qualitative coding handbook beyond templated section output. This is a material purpose mismatch, not merely an implementation detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's core behavior is not limited to coding survey responses; it can audit arbitrary directories, inspect repositories, scan files for secret-like strings, and validate skill packages. That capability expansion materially exceeds the declared purpose, creating a misleading trust boundary where users may provide filesystem access to a tool they believe is only performing qualitative survey analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Repository/package auditing functionality is unrelated to the advertised survey-coding task and enables inspection of arbitrary local skill directories and metadata. In the context of an agent skill, hidden or undeclared auditing features increase the chance of unintended access to sensitive project contents and violate least-privilege expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The entire skill description is presented only in Chinese, and there is no indication that language selection is optional or limited to a justified Chinese-only deployment context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises shell execution via python3 and implies reading and writing local files, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host may grant broader capabilities than users expect, increasing the risk of unintended filesystem access or command execution through a seemingly benign survey-analysis skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The title, labels, examples, and risk text are entirely specified in Chinese, which indicates the skill is configured for a single language experience. There is no indication of user opt-in, alternative locale support, or a documented justification that this skill is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code recursively scans arbitrary directories and reads many source/text file types, far beyond what is necessary for qualitative survey response coding. This broad file access increases exposure of unrelated local content and makes the skill materially more dangerous because its declared context would not lead users to expect filesystem auditing behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language output strings such as "结果", "摘要", and other Chinese-only report text, and similar hardcoded Chinese strings recur in other report builders. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not evident in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pattern scanner searches for shell-execution indicators, private URLs, and secret-like material in arbitrary files, which is a security-audit capability rather than survey coding. Even though it does not exfiltrate data by itself, it can surface sensitive strings from user-provided paths and normalize unauthorized inspection under an innocuous skill description.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The invocation examples "把这些开放题回答做主题编码" and "生成可复核的编码手册" describe intended use, but they do not define clear boundaries for when the skill should or should not activate. The README also does not provide negative examples or tighter trigger constraints, which could allow overlap with general research or writing requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses Chinese throughout, including the title and audit conclusions, with no indication that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file is entirely written in Chinese and includes output-format expectations in Chinese without indicating that the user may choose another language. This can be interpreted as a language-policy constraint that defaults to a specific locale without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file uses Chinese throughout its headings and instructional text, which can amount to a language-policy issue if the skill output is implicitly fixed to a specific language. There is no indication that users can opt into this locale or that the skill is intentionally limited to Chinese-language use cases.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire template, including the title and all section labels, is written only in Chinese, which can impose a specific language on users without any stated opt-in or alternative locale. Under the policy rule for natural-language violations, this is a language/locale constraint that is not documented as optional or justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all testing instructions and expected outcomes exclusively in Chinese, with no note that the skill is Chinese-only or that users may select another language. The policy requires flagging language or locale constraints when they are imposed without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.