Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例（干净样例，0 命中）
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
危险废物转移联单与台账核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local hazardous-waste ledger and manifest checker whose code and instructions match its stated purpose and do not show hidden network, persistence, or destructive behavior.
Install only if you intend to process Chinese hazardous-waste ledger and transfer-manifest data locally. The tool can read the input file you provide and runs through Bash/Node, so review the file path before running it and treat its output as arithmetic reconciliation, not legal or regulatory approval.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例（干净样例，0 命中）
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
- The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Natural-Language Policy Violations
Medium
- Confidence
- 81% confidence
- Finding
- The skill’s primary display name, summary, and main descriptive content are presented in Chinese, and the operational instructions in the document are entirely Chinese, with no statement that users may choose another language for interaction or output. This can constitute a language/locale policy issue when a skill effectively imposes a single language without explicit user opt-in.
Vague Triggers
Medium
- Confidence
- 93% confidence
- Finding
- The trigger phrases are broad business-problem descriptions such as '危险废物管理台账对不上' and '年度申报前核对', which can cause the skill to activate in contexts broader than a narrowly scoped hazardous-waste reconciliation task. Overbroad activation increases the chance of unintended invocation, misrouting user requests, and processing sensitive compliance or financial records without sufficiently explicit user intent.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- The file’s natural-language description, labels, advice strings, and expected inputs are entirely in Chinese, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill implicitly requires a specific language without offering opt-in or alternatives.
Natural-Language Policy Violations
Low
- Confidence
- 93% confidence
- Finding
- The JSON value is entirely in Chinese and provides no indication that language selection is optional or configurable. Because SQP-3 applies to all file types and covers language/locale policy violations, this is a natural-language policy concern if the skill is expected to operate for users without prior Chinese-language opt-in.
Static analysis
No suspicious patterns detected.