Security audit

燃气设施安全检查与隐患整改核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This is a local gas-inspection record checker with disclosed limits and no evidence of hidden network use, persistence, credential access, or destructive behavior.

Install only if you are comfortable running a local Node-based checker over gas inspection records. Treat its output as a record-consistency aid, not proof that a facility is safe, compliant, or fully remediated; the skill itself discloses several checks it does not perform.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This is a real trust and safety issue because the skill markets itself as performing comprehensive gas safety and hazard-rectification verification, but the described behavior indicates important checks are missing or weaker than claimed. In a safety-critical compliance workflow, users may rely on the tool's output to decide whether records are complete and compliant, so omitted整改闭环 checks or fake 'source citations' can create false assurance and cause hazardous conditions or regulatory gaps to be missed.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
node scripts/run.mjs --sample # 先看样例

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file-level description, contract text, required input descriptions, findings, advice, and output notes are all hard-coded in Chinese. There is no indication that the skill supports user language selection or that the Chinese-only behavior is a justified region-specific constraint, which can violate language/locale policy for general-purpose skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language interface, help text, and output strings are entirely in Chinese, and there is no indication that users can select another language or that the tool is intentionally limited to a Chinese-only audience. This is a language/locale policy issue because the skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment on L075 says non-JSON input will be treated as plain-text material such as '直接粘贴的合同全文' (full contract text). That actively conflicts with the skill's stated purpose and surrounding usage text, which consistently describe gas facility inspection/remediation records as the only intended material type.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The JSON value on L2 consists entirely of Chinese column headers and records, indicating a fixed language/locale for the skill content. Because this file provides no opt-in, alternative locale, or justification that the skill is region-specific, it presents a natural-language locale policy concern under the stated rule.
Content: No source excerpt is available for this finding.