Security audit

GROMACS Protein Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Markdown guide for GROMACS protein analysis workflows and does not add hidden execution, credential access, persistence, or unrelated authority.

Install only if you want Chinese-language guidance for GROMACS protein simulation analysis. Review generated shell commands before running them because they create or append local analysis files, but no hidden high-impact behavior was found.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: 该描述写明“当 Agent 需要执行某个分析但不清楚具体流程时调用”，这是一个宽泛的内部状态触发条件，而不是明确、可验证的调用边界。文中也没有列出具体触发短语、适用范围限制或反例，容易让技能在泛化的“需要分析流程指导”场景下被过度调用。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 文件中的名称和整段描述均以中文固定呈现，未说明可根据用户语言偏好切换，也未提供语言选择或光学限制的正当性说明。根据语言/区域政策，技能若隐含强制单一语言输出而无用户选择，应视为自然语言策略问题。
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all instructions and explanations exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language/locale policy requirements when users are not given opt-in or an explicit justification for the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill description and instructions are written in Chinese, with no indication that the language is selectable or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill documentation is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 该技能文档全文以中文编写，未说明这是面向特定中文用户群体的区域性技能，也未提供用户语言选择或替代说明。按自然语言策略要求，强制单一语言而无用户选择可能构成语言/locale 策略违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all user-facing instructions and explanations exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill documentation is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is required for a region-specific purpose. Under the policy, a fixed language choice without user opt-in can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: 该 markdown 文件的全部说明、步骤和问答均以中文呈现，没有任何提示表明用户可选择其他语言或该技能仅面向特定中文使用场景。根据规则，未获用户选择或无明确合理说明的语言/locale 强制属于自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content is written in Chinese and does not indicate that other languages are supported or that the user can choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.