Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Security audit
安全隐患排查整改闭环核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local Chinese safety-ledger checker whose scripts match the stated purpose and do not show network use, persistence, credential access, or hidden destructive behavior.
Install only if you want a local tool for Chinese safety hazard rectification ledger checks. It is not a legal, regulatory, or on-site safety determination, and users should provide only the ledger text or input file they intend to analyze.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill declares trigger phrases including broad domain terms such as “隐患排查治理台账” and “安全隐患排查与整改台账材料对不上,” which can appear in ordinary conversation or document content rather than a deliberate request to invoke the skill. This creates an invocation-squatting risk: the skill may auto-match when a user is merely discussing safety-compliance materials, causing unintended execution and possible exposure of local document contents to the skill’s processing pipeline.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file hardcodes Chinese-language descriptions, warnings, remediation text, and user-facing advice throughout the skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing description, help text, status messages, and usage instructions are entirely in Chinese, with no indication that another language is supported or that the user can opt into Chinese. This can violate language/locale policy when a skill imposes a specific language by default without user choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The JSON value is entirely presented in Chinese, including headers and record content, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy rule, forcing a specific language without user choice or clear justification is a natural-language policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本其余说明和 manifest 都将用途限定为“安全隐患排查与整改台账材料”核对。代码本身也将该文本继续交给安全隐患台账核对引擎处理，因此这里的“合同全文”示例与实际技能意图相矛盾，容易误导调用者对适用输入范围的理解。
- Content