Security audit

食堂进货查验与留样记录核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local, disclosed checker for Chinese canteen purchase-inspection and food-sample records, with no evidence of network use, persistence, credential access, or hidden behavior.

Install this only if you want a local Chinese-language checker for canteen purchase-inspection and food-sample records. It reads the input file you choose and prints findings locally; still review the disclosed free-version limits because it does not perform several fuller compliance checks such as 48-hour retention, certificate validity, shelf-life checks, or disinfection gap detection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看内置样例（干净样例，0 命中）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad operational phrases such as ‘餐具消毒记录’, ‘食堂每月自查’, and ‘监管抽查前自查’ that can match user requests outside the narrowly described purchase-inspection and sample-retention scope. This can cause the skill to activate in unrelated food-safety workflows, increasing the chance of inappropriate routing, user confusion, or over-collection of sensitive business records for tasks the tool does not actually perform.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file’s user-facing documentation, examples, advice strings, and output messages are entirely in Chinese, and there is no indication that the skill supports other languages or requires Chinese by design. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The only natural-language content in this manifest-style JSON is a tabular template entirely in Chinese, including headers and values, with no indication that language selection is optional or region-specific. Under the language/locale policy rule, this is a natural-language constraint that forces a specific language without user opt-in.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The manifest describes a free version limited to six specific record checks with per-conclusion line references. In addition to those checks, the code computes and returns broader aggregate metrics such as totals, day counts, expected/missing sample slots, and recognized-column counts in `summary` and `scope`, which are extra analytics not stated in the manifest's six-item scope.

Intent-Code Divergence

Low

Confidence: 77% confidence
Finding: The file-level documentation repeatedly states this skill is for 食堂进货查验与留样记录核对, but the inline docstring for loadInput says non-JSON content is handled as plain-text material such as a full contract. That comment broadens the apparent intent beyond canteen inspection records and conflicts with the narrowly described purpose.

Static analysis

No suspicious patterns detected.