Chinese Sensitive Words

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:17 AM UTC
• Version: 1.0.5

Overview

This skill is a purpose-aligned Chinese sensitive-word checker, but it sends checked text to a hosted API and users should treat that service as an external data processor.

Install only if you are comfortable sending checked text to the default external API or if you configure a trusted private SENSITIVE_WORDS_API_BASE. Do not submit confidential drafts, personal data, or regulated content based solely on the package's retention claim unless you have separate trust in the service operator.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior promises local sensitive-word analysis, platform-specific detection, risk grading, and privacy-sensitive filtering features, but the finding indicates the implementation mainly proxies to a remote suggestion/quota service and does not perform the claimed checks. This mismatch can cause users to rely on nonexistent compliance protections, leading to unsafe publication of content and unintended disclosure of text to an external service.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check.sh (reported line 13)May include surrounding context.

sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"

# Load specific variables from .env if exists
if [[ -f "$ENV_FILE" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/suggestions.sh (reported line 12)May include surrounding context.

sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"

# Load specific variables from .env if exists
if [[ -f "$ENV_FILE" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check.sh (reported line 15)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"

# Load specific variables from .env if exists
if [[ -f "$ENV_FILE" ]]; then
  while IFS='=' read -r key value; do
    case "$key" in

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/suggestions.sh (reported line 14)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"

# Load specific variables from .env if exists
if [[ -f "$ENV_FILE" ]]; then
  while IFS='=' read -r key value; do
    case "$key" in

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises shell-based commands (check.sh, suggestions.sh) and declares required binaries, but does not declare an explicit tool scope such as permissions or allowed-tools. That creates an avoidable trust gap: a host may allow broader shell execution than users expect, especially for a skill that also communicates with a remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description does not prominently warn users that their input text is sent to a third-party remote API for processing. In a content-compliance tool, submitted text may contain unpublished marketing copy, internal policy text, or sensitive personal data, so lack of clear disclosure materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation assures users that submitted text 'will not be stored or shared,' yet the skill sends that text to a remote API with no verifiable technical control, contract, or audit mechanism enforcing the claim. This is dangerous because users may submit proprietary, regulated, or sensitive text based on a privacy guarantee that the skill cannot substantiate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments, usage strings, and runtime output are all fixed in Chinese, which effectively forces a specific language for interaction. The file does not provide user opt-in, language selection, or a documented justification that the tool is intentionally limited to Chinese-speaking users only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script transmits the full user-supplied text to a third-party remote API endpoint, but the CLI output and usage text do not clearly warn users that their content leaves the local machine. Because this tool is marketed for scanning marketing copy, scripts, and posts, users may submit sensitive draft, business, or regulated content without realizing it is being sent off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The script sends user content and potentially an authorization bearer token to an external network service. Even though HTTPS is used by default, this is still an external data transmission boundary and is significant because the scanned content may contain sensitive unpublished material, personal data, or compliance-sensitive text.

Content

Scanner excerpt · scripts/check.sh (reported line 135)May include surrounding context.

sh

fi

# Call API
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" \
  -X POST \
  "${HEADERS[@]}" \
  -d "$PAYLOAD" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing messages and usage text in the script are written only in Chinese, with no indication that the skill is intentionally region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without opt-in or justification is a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script makes an outbound request to a third-party API endpoint, potentially transmitting usage metadata and any associated authentication token, but it does not present a clear user-facing disclosure at runtime. In a security-sensitive or privacy-conscious environment, silent network egress to an external domain can surprise users and lead to unintentional data exposure or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script loads SENSITIVE_WORDS_TOKEN from a local .env file and uses it for authorization, but there is no user-facing notice that credential material is being read from disk/environment. This is a sensitive operation under the warning criteria, and the file's visible usage/help text does not mention it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.