Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（一张干净表，应报 0 条问题）
Security audit
政府补助与专项验收核对（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local, read-only checker for Chinese government subsidy ledger tables and does not show network use, persistence, hidden code execution, or data exfiltration.
Install only if you are comfortable running a local Node-based checker on Chinese subsidy ledger text. It handles business/financial table contents locally and read-only, but its conclusions are limited to arithmetic and checklist completeness; it is not a legal, audit, eligibility, or policy decision tool.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（一张干净表，应报 0 条问题）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --sample # 先看内置样例（一张干净表，应报 0 条问题）
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s top-level description, user-facing advice, and operational messaging are all written in Chinese, indicating the skill is designed to communicate in a fixed language. There is no natural-language indication that users may choose another language or that the locale restriction is optional or justified as a region-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The user-facing description, usage text, prompts, and outputs are entirely in Chinese, and the skill does not indicate any option to choose another language or locale. Under the policy, a skill that effectively requires a specific language without opt-in is a natural-language policy concern unless the constraint is explicitly justified as region-specific.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description says the trigger words 'include' two phrases, but it does not define the full trigger scope, when the skill should not activate, or any exclusion examples. This can make invocation behavior ambiguous, especially because one listed phrase is a symptom-style complaint rather than a tightly bounded command.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The comment says non-JSON content will be treated as plain-text material such as a 'full contract text', which broadens the apparent supported input beyond the manifest's stated scope of reconciling subsidy ledgers and acceptance-material comparison tables. The implementation does pass arbitrary plain text through to the engine, so the inline documentation suggests a wider intent than the declared skill purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The JSON payload consists entirely of Chinese-language headers and status text, with no indication that language is selectable or optional. Under the policy for natural-language violations, fixed language content can be a locale-policy issue when the skill does not document user opt-in or justified regional scope.
- Content