Security audit

建筑企业月度自查包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language construction finance checker that reads user-provided text and shows no network, credential, persistence, or data-changing behavior.

Use this only for Chinese-language construction finance self-checks, and treat outputs as arithmetic/reconciliation assistance rather than accounting, legal, audit, or tax advice. Provide only the materials needed for the check, and review the listed checks not run before relying on a clean result.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding likewise identifies a serious claims-vs-behavior inconsistency, here suggesting only the production/progress-confirmation logic exists while the other two advertised categories do not. Even if the exact missing category differs across static findings, the core security-relevant issue is the same: overstated assurance in a financial review skill can conceal unreviewed risk areas and produce false operator confidence.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest text says the skill is triggered by phrases including “月底核对”, “月度自查”, and especially “对不上怎么办”. These are generic phrases that could appear in normal accounting or project discussions without intending to invoke this specific skill, and no exclusion conditions or narrowing context are provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level comments and all user-facing guidance are written exclusively in Chinese, including input instructions and behavioral disclaimers. Because the skill does not offer a language choice or explicitly justify that it is limited to a Chinese-only regional workflow, this appears to impose a specific language/locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language guidance, labels, messages, and disclaimers in the file are written entirely in Chinese, and there is no indication that the skill offers a language choice or that it is intentionally restricted to a Chinese-speaking or region-specific context. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language description, labels, advice strings, and required input headers are entirely in Chinese, and the contract in L017-L018 gives no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language instructions, messages, and user-facing guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-facing natural-language content, including the title, usage, help text, status messages, and error descriptions, is entirely in Chinese. There is no indication that the skill is region-specific or that users can choose another language, which can violate language/locale policy requirements for opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The user-facing summary and descriptions are written entirely in Chinese and describe invocation phrases only in Chinese, while the English description is minimal and does not indicate equivalent English usage. This may violate a language-choice policy if users are expected to be able to opt into another language or locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The JSON value at L2 is entirely in Chinese, including section headings and field labels, which imposes a specific language/locale on users. Under the policy, locale-specific language is only acceptable when the skill offers user choice or clearly documents and justifies the constraint, neither of which appears in this file.
Content: No source excerpt is available for this finding.