Security audit

安全隐患排查整改闭环核对（免费版）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese safety-ledger checker whose scripts match the stated purpose and do not show network use, persistence, credential access, or hidden destructive behavior.

Install only if you want a local tool for Chinese safety hazard rectification ledger checks. It is not a legal, regulatory, or on-site safety determination, and users should provide only the ledger text or input file they intend to analyze.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill declares trigger phrases including broad domain terms such as “隐患排查治理台账” and “安全隐患排查与整改台账材料对不上,” which can appear in ordinary conversation or document content rather than a deliberate request to invoke the skill. This creates an invocation-squatting risk: the skill may auto-match when a user is merely discussing safety-compliance materials, causing unintended execution and possible exposure of local document contents to the skill’s processing pipeline.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This file hardcodes Chinese-language descriptions, warnings, remediation text, and user-facing advice throughout the skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The user-facing description, help text, status messages, and usage instructions are entirely in Chinese, with no indication that another language is supported or that the user can opt into Chinese. This can violate language/locale policy when a skill imposes a specific language by default without user choice or justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The JSON value is entirely presented in Chinese, including headers and record content, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy rule, forcing a specific language without user choice or clear justification is a natural-language policy violation.

Intent-Code Divergence

Low

Confidence: 93% confidence
Finding: L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该脚本其余说明和 manifest 都将用途限定为“安全隐患排查与整改台账材料”核对。代码本身也将该文本继续交给安全隐患台账核对引擎处理，因此这里的“合同全文”示例与实际技能意图相矛盾，容易误导调用者对适用输入范围的理解。

Static analysis

No suspicious patterns detected.