Security audit

敏感词筛查-CMT

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its output handling can overwrite the original document without a clear safeguard.

Review this skill before installing if you work with important contracts or business documents. Use a separate output folder that is not the source folder, keep backups of originals, and install dependencies in a virtual environment from pinned, trusted packages where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:94
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
openpyxl== PyPDF2== PyMuPDF== ``` 2. Generate and record cryptographic hashes for every direct and transitive dependency. 3. Require hash verification during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a lock-file generation process that resolves and pins all transitive dependencies. 5. Configure installation to use an explicitly approved package index or an internally controlled package mirror. 6. Regularly scan locked dependencies for known vulnerabilities and review updates before changing pinned versions. 7. Recommend installation in an isolated virtual environment without administrator privileges. 8. Update both `SKILL.md` and `references/usage.md` so users no longer receive unrestricted installation instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sensitive_word_checker.py:474
Finding: Output Path Construction Can Overwrite the Source Document
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
脚本位于当前 skill 目录下的 `scripts/sensitive_word_checker.py`。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to generate annotated output files, but it does not declare any explicit tool scope such as allowed file-write permissions. This creates a governance gap where the skill's effective capability exceeds what is documented, increasing the risk of unintended file modification or writes to unsafe locations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill describes scanning and highlighting content but does not clearly warn users that their documents will be modified and that new annotated files will be created. This undermines informed consent and can lead to accidental alteration of sensitive business documents or confusion about where changed files are stored.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger keywords include very common terms like '检查', '审核', and '标注', which can cause the skill to activate in situations unrelated to sensitive-word screening. Over-broad invocation increases the chance that unrelated user documents are processed and modified without clear intent, especially because the skill writes annotated output files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill checks files for sensitive words and highlights them in yellow, which implies highlighting the matched words. For Word the code implements precise word-level highlighting, but for Excel it colors the entire cell whenever any sensitive word appears, creating a behavior mismatch with the stated/documented purpose of highlighting the matched terms themselves.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest states the skill should check PDF files and highlight sensitive/prohibited words in yellow. In the fallback branch, the code extracts text, detects matches, then simply copies the original PDF to the output path without adding any highlight annotations, so supported PDF behavior no longer matches the described functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Most of the operational instructions and usage guidance are written only in Chinese, which can impose a language constraint without user opt-in. The file does not state that the skill is intended only for Chinese-speaking users or provide an alternative language option.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.