Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例（干净样例，0 命中）
Security audit
危险废物转移联单与台账核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local hazardous-waste ledger and manifest checker whose code and instructions match its stated purpose and do not show hidden network, persistence, or destructive behavior.
Install only if you intend to process Chinese hazardous-waste ledger and transfer-manifest data locally. The tool can read the input file you provide and runs through Bash/Node, so review the file path before running it and treat its output as arithmetic reconciliation, not legal or regulatory approval.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例（干净样例，0 命中）
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill’s primary display name, summary, and main descriptive content are presented in Chinese, and the operational instructions in the document are entirely Chinese, with no statement that users may choose another language for interaction or output. This can constitute a language/locale policy issue when a skill effectively imposes a single language without explicit user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad business-problem descriptions such as '危险废物管理台账对不上' and '年度申报前核对', which can cause the skill to activate in contexts broader than a narrowly scoped hazardous-waste reconciliation task. Overbroad activation increases the chance of unintended invocation, misrouting user requests, and processing sensitive compliance or financial records without sufficiently explicit user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s natural-language description, labels, advice strings, and expected inputs are entirely in Chinese, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill implicitly requires a specific language without offering opt-in or alternatives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The JSON value is entirely in Chinese and provides no indication that language selection is optional or configurable. Because SQP-3 applies to all file types and covers language/locale policy violations, this is a natural-language policy concern if the skill is expected to operate for users without prior Chinese-language opt-in.
- Content