Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
检测样品流转与留样期限核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This is a local lab-ledger checking skill that matches its stated purpose and does not show hidden network, credential, persistence, or destructive behavior.
Install only if you are comfortable using a Chinese-language local checker for lab sample ledgers. It runs locally and prints source-line evidence from the submitted ledger, so avoid feeding it files or rows you do not want shown in terminal output.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Content
node scripts/run.mjs --sample # 先看样例
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
- The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- This JavaScript file embeds its contract, instructions, warnings, and output text entirely in Chinese, including the advice returned to users and the expected field names. The policy allows locale constraints only when the skill offers user opt-in or clearly documents a justified region-specific limitation, which is not stated here.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The user-facing natural-language content, including the capability name, usage, help text, and runtime messages, is entirely in Chinese. There is no indication that the skill offers language selection, honors user locale, or is limited to a clearly justified Chinese-only deployment context, which can violate language/locale policy requirements.
Intent-Code Divergence
Low
- Confidence
- 97% confidence
- Finding
- The inline documentation says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the skill's stated and actual purpose of checking sample transfer and retention ledger materials. The implementation does process arbitrary plain text, but the comment's example points to a different document type and misstates the intended input domain.
Natural-Language Policy Violations
Low
- Confidence
- 95% confidence
- Finding
- The JSON contains a large natural-language text payload entirely in Chinese, with no indication that language selection is optional or configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Static analysis
No suspicious patterns detected.