Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
食品添加剂使用记录核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This is a local food-additive ledger checker with no evidence of network access, credential use, persistence, or destructive behavior, though its documentation has minor scope and language limitations.
Use this only for the disclosed local ledger checks, and independently verify food-safety or regulatory conclusions against the current GB 2760 standard and qualified review. Expect Chinese-language documentation and note that several advanced checks are explicitly listed as not run in this free version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The user-facing documentation from the main heading onward is entirely in Chinese, including usage instructions and warnings, while the skill metadata only provides an English description summary. There is no explicit statement that users may interact in other languages or select a preferred language, which can violate a language/locale policy requiring user choice or opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The OUT_OF_SCOPE text states the tool '只把台账里的使用量与台账里的限量值按比例复算', implying a narrow arithmetic/text cross-check scope. Yet the same out-of-scope block and nearby comments describe using a built-in category-allow whitelist to '点名', while the runtime never executes any whitelist-based '超范围使用' check in this file, creating active contradiction between documentation of intent and actual behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description limits the free version to six checks such as ratio recomputation, limit-value inconsistency, label consistency, duplicate rows, totals review, and field/date validity. However, the code embeds a category-to-allowed-additive whitelist and carry-in-only rules intended for '超范围使用' determinations, which is a separate withheld/premium-style regulatory capability not disclosed as part of the free skill behavior.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The comment says non-JSON input will be treated as plain-text material such as '直接粘贴的合同全文', which contradicts the skill's stated purpose and the surrounding code/usage text that expects a 食品添加剂投料与使用台账. This is not just incomplete documentation: it actively describes a different document type than the skill is designed to process.
- Content