Security audit

药品冷链温控与出入库记录核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language checker for drug cold-chain records and its file access and script execution match that purpose.

Install only if you want a Chinese-language local checker for the six listed cold-chain and inventory record consistency checks. Do not rely on it for omitted checks such as超温处理闭环, drug quality decisions, regulatory certification, trace-code verification, or original instrument/PDF/XLSX review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 核心功能大体匹配：该代码确实是药品冷链温控与出入库记录台账核对器，且执行的 6 个具体检查与声明基本一致，也符合“本机运行、引用行号与原文、无网络访问”的描述。之所以判定为不完全匹配，是因为声明措辞“本免费版执行引擎声明的 6 项检查，即……全部核对过程在本机运行”容易让人理解为该技能对所述冷链/GSP核对场景的完整免费版能力就是这些并已充分覆盖；而代码文件顶部与结果结构反复强调这只是子集，明确未实现多项与用户触发词强相关的检查（超温处理闭环、储存条件匹配、运输在途温度、超温批次追溯、整改清单）。尤其“超温报警”“GSP 飞检整改”这些触发语，会让人预期工具会检查超温处理闭环或给整改导向输出，但实际没有，只做温度是否越界和报警状态取值是否合法。因此这是描述范围与实际能力边界存在材料性偏差，而不是完全错误描述。

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例（内置一张干净台账）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例（内置一张干净台账）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例（内置一张干净台账）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file's docstrings, usage text, error messages, and normal output are all hard-coded in Chinese, with no indication that users may select another language or locale. This is a natural-language policy concern because the skill imposes a specific language across its interface rather than documenting a justified locale restriction or offering opt-in.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The JSON template consists entirely of Chinese field names and record text, with no indication that language selection is configurable or that the file is intended only for a Chinese-language or region-specific context. Under the policy rule for natural-language violations, hard-coding a single locale without opt-in or justification is a reportable issue.

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: The doc comment for loadInput states that if the file is not valid JSON it will be treated as plain-text material, which matches the implementation. However, the parenthetical example says '例如直接粘贴的合同全文', which contradicts the skill's stated purpose of checking drug cold-chain temperature and inventory records rather than generic contract text. This is an intent/documentation mismatch rather than a code-behavior issue.

Static analysis

No suspicious patterns detected.