Security audit

制造与生产技能包（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local manufacturing worksheet checker that reads user-provided files, runs deterministic checks, and does not show evidence of hidden network, persistence, or destructive behavior.

Install only if you are comfortable using a Chinese-language, local Node.js checker for manufacturing worksheets. Provide it only the worksheet directories you want analyzed; it does not replace audit, legal, or business approval review, and withheld items are not executed in this free version.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单对象样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单对象样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单对象样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 单对象样例（内置）
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill’s title, summary, descriptions, usage guidance, and operational instructions are predominantly in Chinese, while the English content is limited to a short metadata description. This creates a language/locale constraint for users without explicitly offering a language choice or documenting that the skill is intended only for a Chinese-language audience.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JavaScript file contains extensive natural-language instructions, comments, sample object names, advice, notes, and disclaimers entirely in Chinese. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the skill offers a language choice or clearly documents a justified regional constraint, which this file does not.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The comment at L333 states that the following functions are only called in the full version and that their conclusions are not output in the free package. However, the main `run` result still constructs and returns full-version-related containers like `overuse_by_group`, `action_plan`, and `checks_not_run`, which contradicts the stated intent that these paid-path elements are not part of free output.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file header says this free package only implements the free subset and that paid-tier capabilities are not implemented here, but the returned result still includes paid-tier shaped outputs such as `overuse_by_group`, `action_plan`, and `checks_withheld`/`checks_not_run`. Even though these are empty or descriptive, the runtime behavior goes beyond a narrowly free-check-only result contract and surfaces artifacts of the withheld feature set.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The file’s natural-language interface, guidance, error messages, and result text are written entirely in Chinese, including the documented contract and user-facing responses. Because there is no opt-in, fallback, or documented region-specific justification, this is a locale policy concern under the language-choice rule.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JavaScript skill embeds its descriptive contract, input guidance, labels, and user-facing output text entirely in Chinese, with no indication that other languages are supported or that the user can opt into Chinese. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as a justified region-specific tool.

Static analysis

No suspicious patterns detected.