Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Security audit
医疗废物交接与暂存记录核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local medical-waste record checker with disclosed scope and no evidence of network access, credential use, persistence, or destructive behavior.
Install only if you are comfortable running a local Node-based checker on Chinese medical-waste transfer records. Treat it as an aid for the listed free checks, not as a complete regulatory compliance determination; it explicitly does not verify document authenticity, signatures, waste classification correctness, disposal-unit credentials, or the withheld paid/full checks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看样例
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds the skill description, usage text, error messages, and findings entirely in Chinese, which effectively forces a specific language/locale on all users. The file does not indicate that the skill is region-specific only, nor does it provide any opt-in or language selection mechanism.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI comments and sample path imply a paid/full mode is executed, but run() ignores the full flag and always performs only the free subset. This can mislead operators into believing additional safety/compliance checks were performed when they were not, creating a dangerous false sense of assurance in a medical-waste compliance workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON template embeds all headers and content in Chinese, which imposes a specific language/locale in natural-language output. Under the policy rules, forcing a language without user opt-in or justification is a reportable locale-policy issue.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline documentation states that non-JSON input will be treated as plain-text material such as a pasted '合同全文' (full contract text). That directly conflicts with the skill's stated purpose and surrounding help text, which consistently require a medical waste transfer/registration table with headers.
- Content