Security audit

行业专项技能包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local business worksheet checker with no evidence of network access, credential use, persistence, or automatic file modification during its documented use.

Install only if you are comfortable giving the skill local read access to the institution materials you point it at. Use the documented node scripts/run.mjs commands for checking, treat outputs as reconciliation aids rather than audit or policy opinions, and avoid running rebuild_free.py unless you are maintaining the package source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation is only a vehicle-insurance amortization subset, then the skill's package-wide claims are misleading. In business-ops contexts, such mismatch can produce incorrect internal controls or reconciliation sign-off.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单机构样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单机构样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单机构样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单机构样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp1

High

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The script writes to a package source file (`FREE.write_text(...)`) even though the skill manifest describes a local auditing/reporting tool, not a package-rebuilding utility with source modification capability. This mismatch means the skill exposes filesystem modification power that users and policy layers may not expect, increasing the risk of unauthorized file changes or supply-chain tampering if the script is invoked in an automated agent context.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file is a self-described build/reconstruction script for regenerating a free package engine, which materially differs from the manifest's promised functionality of auditing institution materials across 14 industry topics. This kind of capability drift is dangerous because users, orchestrators, and reviewers may trust the package for one purpose while it contains tooling for modifying product artifacts, creating a supply-chain and transparency risk.

Scope Creep

High

Confidence: 98% confidence
Finding: Writing rebuilt engine code back into the package source exceeds the manifest's implied read/analyze/report scope and gives the skill artifact-modification capability. In an agent ecosystem, this can be abused to alter code or outputs on disk, and it undermines trust that the skill is only performing local audits rather than mutating its own implementation or nearby files.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The natural-language user-facing instructions in the markdown body are almost entirely in Chinese, which effectively forces a specific language for users reading the skill documentation. Although a short English description exists in metadata, the operational guidance and usage details do not offer a language choice or indicate that the Chinese-only instructions are intentional for a specific audience.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file's natural-language interface is entirely in Chinese, including the module docstring, usage instructions, status messages, and the --check help text. This imposes a specific language on users without any documented opt-in or language-selection mechanism, which matches the language/locale policy violation category.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: rebuild_free.py:43