心理测评

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

This is a coherent Chinese mental-health assessment skill, but it handles highly sensitive answers and creates previewable HTML reports with insufficient consent/scoping and an HTML-injection weakness.

Review this carefully before installing if users may provide private mental-health information. It should ideally ask for explicit consent before starting, explain that a sensitive HTML file will be generated and previewed/delivered, restrict or confirm output paths, and escape or validate all report data before rendering HTML.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:55

Finding

Unescaped HTML Injection in Generated Assessment Reports

Content

View full analysis

' f'

' f'

{r["name"]}

' f'

{t.get("severity","")}

' f'

{r["total_score"]}/{r["max_score"]}

' f'' ) html = html.replace("{{SUMMARY_GRID}}", "\n".join(summary_parts)) ``` ```python scale_html_parts.append( f'

' f'

{r["name"]}

' f'

' f'

' f'{r["total_score"]}' f'/{r["max_score"]}' f'

' f'

' f'

' f'

0{r["max_score"]}

' f'

{t.get("severity",r.get("level",""))}

' f'

' f'

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes file-reading and file-writing behavior via referenced scripts and report generation, but it does not declare an explicit tool scope such as allowed tools or permissions. In a skill that processes highly sensitive mental-health responses and generates local HTML artifacts, undeclared capabilities increase the risk of overbroad agent access, accidental data exposure, or unexpected file operations beyond what the user understands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list contains broad, everyday phrases like '心理健康' and generic '心理测试' variants that can cause unintended invocation in ordinary conversation. Because this skill handles sensitive mental-health screening and may collect intimate answers or generate assessment reports, accidental activation raises privacy and consent risks beyond a normal low-stakes utility skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes generating, previewing, and delivering an HTML report containing mental-health screening results, but it does not clearly warn the user up front that a file containing sensitive health-related data will be created and shared back to them. This is dangerous because users may disclose depression, anxiety, stress, self-harm indicators, and personality data without informed consent about artifact creation, retention, or exposure surfaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The HTML root sets lang="zh-CN", and the visible report content is entirely in Chinese, which enforces a specific language/locale experience. The file does not indicate that this is optional, user-selectable, or limited to a China-specific deployment context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill reference is written only in Chinese, including instructions, interpretation text, and crisis-support guidance, with no indication that language choice is optional or configurable. This can violate language/locale policy where skills must not force a specific language unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings in the docstring and CLI output are entirely in Chinese, and the script provides no language selection, opt-in, or justification that it is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy when skills must not force a language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits help, status, and error messages only in Chinese, which imposes a specific language on all users. Because there is no opt-in, fallback, or documented locale restriction, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module description and CLI usage are entirely Chinese and the skill’s behavior is oriented to Chinese-language output, but there is no indication that users can opt into another language or that the tool is intentionally restricted to a Chinese-only deployment context. Under the language/locale policy, a skill should not implicitly force a specific language unless choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description and trigger phrases are written to operate in Chinese, and the workflow later instructs the agent to maintain that mode, but there is no indication that users may opt into another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs a filesystem write to a path provided by the user, which can overwrite an existing file, but there is no confirmation prompt or explicit user-facing warning at the point of execution. While file output is part of the script's purpose, the code does not disclose overwrite behavior or other write-side effects beyond the usage string.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.