Light IDE 简报 PPT

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 2:05 AM UTC
• Version: 1.2.1

Overview

This skill is a tightly scoped HTML presentation template and validator with no hidden network, credential, persistence, or destructive behavior found.

Install this if you want the fixed Light IDE HTML deck style. Expect the agent to read the bundled template/reference files, create or modify an HTML deck at the path you choose, and run the included Python validator on that deck. The package is Chinese-oriented, so users needing fully localized non-Chinese output may need to adjust expectations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a presentation generator, but the instructions also require invoking a validator script over filesystem paths and mention integrity/auditing behaviors not reflected in the declared purpose. This mismatch can cause security controls, reviewers, or users to underestimate that the skill performs local file inspection and command execution adjacent actions, which broadens the effective attack surface beyond the stated use case.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to read local files such as assets/template.html and multiple reference documents, and to validate output via a local script, but it declares no explicit tool scope or allowed-tools. That creates an authorization gap where an agent may access filesystem resources implicitly without a clear least-privilege boundary, increasing the chance of overbroad file access in environments that rely on manifest-declared permissions.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The template sets the document language to `zh-CN`, which imposes a specific locale by default. Under the policy, forcing a language or locale without user opt-in or clear region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Line L03 explicitly says '只使用模板' and the entire document is written as prescriptive Chinese instructions, which imposes a specific language/locale without any opt-in or alternative. This matches the policy category for language or locale constraints that are not optional or justified.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents its operational instructions entirely in Chinese, including explicit editing guidance, while also embedding mixed-language template content such as 'ENGLISH KICKER'. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-language audience, which can violate a language/locale policy requiring user choice or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The manifest tags the skill with "chinese", and the tagline/description at L04-L05 are bilingual with explicit Chinese-language instructions, but the manifest does not indicate that language selection is optional or user-configurable. This can be read as a locale/language constraint without opt-in, which falls under natural-language policy concerns.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file contains operational instructions entirely in Chinese, which can impose a language constraint on users without any opt-in or justification. The policy for natural-language violations applies to all file types and specifically calls out forced language or locale requirements.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This code includes multiple natural-language strings exclusively in Chinese, such as placeholder replacements and slide-title expectations, which indicates the skill behavior is tied to a specific language/locale. The file does not provide any opt-in, language selection, or justification that the skill is intentionally region- or locale-specific.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The validator specifically checks for the Chinese placeholder string "[必填]" and treats it as the unfinished-placeholder marker. This embeds a language-specific convention into the skill behavior without indicating that other locales are supported, which can violate language/locale neutrality expectations.

Static analysis

No suspicious patterns detected.