Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Security audit
食堂进货查验与留样记录核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local canteen-record checker and I found no hidden networking, persistence, or data exfiltration behavior.
Install only if you are comfortable using a Chinese-language local Node tool for canteen inspection and sample-retention tables. It requires running a local Bash/Node command and reading the input file you provide, but I found no evidence that it sends data off-machine or changes files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file-level documentation and all user-facing guidance are written entirely in Chinese, and the contract/advice strings returned by the skill are also Chinese-only. There is no indication that the user can choose another language or that the locale restriction is region-specific and intentionally documented as such.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The OUT_OF_SCOPE text says the tool only checks whether disinfection records have gaps, while the main free-version description and manifest emphasize six checks that do not include any executed disinfection-gap check. This creates contradictory intent messaging inside the file: one part frames disinfection-gap checking as within tool scope, while the actual free implementation does not execute it.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest says the free version only executes six deterministic checks around purchase reconciliation, sample completeness/weight, duplicate supplier-batch entries, and blanks/unrecognized formats. However, the sample data, top-level documentation, and result metadata repeatedly incorporate dishware disinfection, 48-hour sample retention, license expiry, and shelf-life concepts that the free engine claims are withheld, creating a broader apparent operational scope than the manifest promises.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The insufficient-input advice returned to users is hardcoded in Chinese and does not offer localization or user opt-in. This can violate a language/locale policy where skills must not force one language unless clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The JSON template's only user-facing text is entirely in Chinese, including all field headers and sample values, with no indication that other languages are supported or that Chinese is an optional locale. This creates a language/locale policy concern because the skill content appears to require a specific language without offering user choice or documenting a justified regional constraint.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comment says non-JSON input is treated as plain text material, giving '直接粘贴的合同全文' as an example. That contradicts the skill's stated purpose and the surrounding help text, which consistently limits the tool to 食堂进货查验与留样记录材料 rather than arbitrary contracts.
- Content