Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
- 声明描述的核心能力是评估 Skill 的质量并自动评分，但给出的代码片段只是在本地检查 Python 运行环境是否满足最低版本要求。虽然环境检查可能是某个更大系统的辅助组件，但就该代码片段本身而言，其实际行为与声明的主要用途明显不一致。代码没有读取或分析 Skill 包、SKILL.md，也没有执行任何审查、评分、诊断逻辑，因此应判定为描述与行为不匹配。
Security audit
Skill Reviewer
Security checks for vulnerabilities and agentic risk
Overview
This is a read-only skill reviewer whose behavior matches its stated purpose, with some broad trigger wording but no hidden mutation, credential access, network use, persistence, or target-code execution found.
Install only if you want an agent to inspect skill packages or SKILL.md content for review. When using it manually, run its bundled scripts from this skill package, not scripts from the package being reviewed, and expect some Chinese-first output from the command-line helpers.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Vague Triggers
High
- Confidence
- 95% confidence
- Finding
- The activation rule is overly broad and tells the agent to proactively use the skill for loosely defined requests about evaluating skills. Over-broad triggering can cause the skill to activate in unintended contexts, increasing the chance of unsafe file access, mis-scoped analysis, or accidental processing of adversarial content without clear user intent.
Intent-Code Divergence
High
- Confidence
- 96% confidence
- Finding
- The skill claims the audited package is treated as untrusted and that review is read-only, yet it instructs running a Python script from the target skill directory. That creates a code-execution path on attacker-controlled content, enabling arbitrary code execution, data exfiltration, or environment tampering under the guise of analysis.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- Treating 'simply providing a SKILL.md' as sufficient to trigger the skill is ambiguous and unsafe because the presence of a file alone does not prove the user wants a security or quality review. This can lead to unsolicited processing of content, accidental override of other more appropriate skills, and increased exposure to prompt-injection content embedded in documents.
Vague Triggers
Medium
- Confidence
- 91% confidence
- Finding
- Treating 'simply providing a SKILL.md' as sufficient to trigger the skill is ambiguous and unsafe because the presence of a file alone does not prove the user wants a security or quality review. This can lead to unsolicited processing of content, accidental override of other more appropriate skills, and increased exposure to prompt-injection content embedded in documents.
Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Natural-Language Policy Violations
Medium
- Confidence
- 85% confidence
- Finding
- The natural-language instructions embed bilingual behavior in the core description, but do not state whether output language should follow the user's preference or provide an opt-in choice. This can violate language or locale policy expectations when a skill imposes or defaults to a language format without user selection.
Natural-Language Policy Violations
Low
- Confidence
- 97% confidence
- Finding
- The docstring and user-facing print messages are entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. Under the policy, hard-coded locale/language restrictions should be flagged unless the file clearly justifies the constraint or offers a choice.
Natural-Language Policy Violations
Low
- Confidence
- 92% confidence
- Finding
- The module docstring presents the script description, usage, output, and behavior entirely in Chinese, and the runtime messages printed to users are also Chinese-only. For a general-purpose skill utility, this is a natural-language locale constraint without any opt-in or documented justification.
Natural-Language Policy Violations
Low
- Confidence
- 89% confidence
- Finding
- The printed status, failure, usage, and error messages shown during execution are all hardcoded in Chinese. This continues the fixed-language behavior without user opt-in or a stated regional/compliance reason.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/score_skill.py:52