Security audit

Taxonomy Normalizer

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese-language taxonomy report skill with no evidence of network access, persistence, hidden destructive behavior, or credential exfiltration.

Install this if you want Chinese taxonomy-normalization drafts from local inputs. Run the script only on files you intend to process, choose output paths carefully, and do not change the spec mode to audit broad directories unless you understand it may enumerate or scan local text files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is taxonomy normalization, but the behavior described in the finding extends into generic directory auditing, file scanning, regex-based sensitive-pattern detection, package auditing, and report generation. That mismatch is dangerous because it hides materially broader operational behavior behind a narrow description, which can lead users to approve a skill that can inspect unrelated files or perform analysis outside its stated business scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for unifying taxonomy systems, preserving alias mappings, and handling deprecated terms in data-governance workflows. However, the main dispatch logic selects modes such as directory auditing, CSV auditing, regex-based pattern scanning, and skill package auditing, none of which implement taxonomy normalization behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable capability via python3 and references local resources for input/output generation, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity: a caller or host may permit broader file and shell access than users expect, increasing the risk of unintended reads, writes, or command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The user-facing title, category label, summary, input hint, examples, and risk text are all presented only in Chinese. This indicates a language-specific experience with no opt-in, alternative locale, or justification that the skill is region-specific, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written in Chinese and the title indicates a fixed Chinese output format, but there is no natural-language note allowing another language or explaining that the skill is intentionally limited to a Chinese-language context. This can violate language/locale policy when users have not explicitly opted into Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated report strings in make_structured_report are hard-coded in Chinese, including headings, prompts, and next-step guidance. This imposes a specific language on all users without offering a choice, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: directory_report emits multiple Chinese section titles and narrative text, again forcing a specific language for generated output. The file does not expose any option for users to choose a different language or opt into Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The csv_report and related audit/report helpers produce user-facing text solely in Chinese, with no language negotiation or configuration. This is a natural-language policy issue because the script enforces one locale by default for all users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The built-in regex patterns search for shell exploitation patterns, secret-like strings, and private/admin URLs, which is a security scanning capability. That capability is not an obvious or declared requirement for normalizing taxonomies across teams and tables, so it exceeds the stated purpose contextually.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill_audit function checks for expected repository files, parses SKILL.md frontmatter, and validates metadata JSON. Repository compliance auditing is not a direct or obvious requirement for taxonomy normalization or alias/deprecation handling in data-governance workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The entire smoke-test document is written in Chinese, which imposes a specific language/locale on users without indicating any option to choose another language or any documented regional justification. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The trigger section lists natural-language phrases like '把这些不同分类体系统一一下' and '保留别名和废弃词映射' without defining when the skill should not activate. Because README.md is in scope for vague-trigger review, this can create ambiguity about whether general taxonomy-cleanup requests outside the intended workflow should invoke the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest description and routing examples are written primarily in Chinese with some English fragments, and the skill text does not state that users may interact in their preferred language. Under the policy, language constraints should either offer a choice or be clearly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.