安全环保与职业健康专家

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 8:35 AM UTC
• Version: 1.0.10

Overview

This is a local EHS table-checking skill with no network or credential behavior found, though it does keep a small local usage counter for its trial limit.

Before installing, understand that this is a Chinese-language local compliance table checker, not a substitute for legal advice, regulator review, or field inspection. It reads only the material you provide, does not appear to send data over the network, and keeps a local trial-use counter in your home directory that may block use after 5 runs and show subscription messaging.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the real logic only covers wastewater fee and water-quality reconciliation, then claiming support for equipment inspections, fire systems, gas safety, and other EHS records is materially misleading. In this context, the danger comes from operational reliance on nonexistent checks, not from traditional exploit primitives.

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --list # 看覆盖了哪些子问题

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest describes a skill that routes among 12 named subskills such as boiler/pressure-vessel inspection, carbon-emissions report checking, elevator maintenance records, fire-facility maintenance, and gas-facility safety checks. This file instead documents and implements a specialized engine for '医疗废物交接与暂存记录核对', a medical-waste handover/storage ledger audit that is not among the manifest’s declared subskills.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s actual behavior materially diverges from the skill’s declared purpose: instead of an EHS/OHS expert covering the listed industrial compliance subskills, it implements a school-bus auditing engine with different required columns, checks, and conclusions. This kind of scope mismatch is dangerous because users or upstream orchestrators may route sensitive industrial compliance data into the wrong analyzer and rely on incorrect or missing conclusions, creating a silent integrity failure in safety/compliance workflows.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The header comment claims the public version contains all 12 sub-skill engines fully in-package and never relies on remote or subscription-only components, yet later logic allows some sub-skills to be absent locally. In a safety/compliance skill, that mismatch is more dangerous because users may assume complete local audit coverage and miss that requested checks are unavailable.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The help output states that all sub-skills are complete, local, and available, but the actual runtime can deny execution for sub-skills whose engines are not present and route users to a subscription version. This creates a trust and integrity problem: operators may believe they have full offline compliance tooling when they do not.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script tells users that all 12 sub-skills are complete and local, but the runtime explicitly checks for missing local engines and redirects some functions to a subscription-only version. This is a deceptive capability claim rather than code execution risk, but it can mislead users into trusting coverage, purchasing under false pretenses, or relying on a package that does not actually contain the promised offline functionality.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger list includes very generic keywords such as “免费”, “对账”, and “核对”, which can match routine user requests unrelated to this EHS skill. That creates over-broad activation boundaries, increasing the chance the wrong subskill is selected and causing unintended processing of user data or misleading compliance conclusions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: These subskills also rely on ambiguous keywords that are common in ordinary business conversations, without scope guards tying them to a specific compliance workflow. An attacker or normal user could unintentionally trigger the wrong checker, leading to misrouting, incorrect validation, or disclosure of compliance-oriented reasoning in the wrong context.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The repeated reuse of broad triggers like “核对” and “对账” across many subskills creates overlapping invocation boundaries throughout the manifest. In a router-driven skill system, this can produce nondeterministic or attacker-influenced routing, which may yield wrong compliance judgments, process the wrong uploaded table, or bypass expected user clarification steps.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains extensive natural-language instructions, messages, and operational guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless clearly justified as region-specific; the file does not explicitly offer a language choice or state such a constraint as a requirement.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript file’s descriptive comments and multiple returned user-facing messages are written exclusively in Chinese, and the skill does not indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Static analysis

No suspicious patterns detected.