T01 · Skill Instruction Hijacking
Error
- Location
templates/detail-report.md:129- Finding
Mandatory Promotional Attribution Injected into Generated Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
industry-intelligence（行业情报）
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent, but it can fetch arbitrary URLs with browser automation and scripts without network-safety limits, so it should be reviewed before installation.
Install only in a sandboxed environment with restricted outbound network access, private-network and metadata-IP blocking, and workspace-scoped file permissions. Review or patch the URL fetchers before using resource files from untrusted sources, and remove the mandatory report attribution if reports must remain user-controlled or organization-branded.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_fetchers.py:18- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:171- Finding
Unpinned Python Packages and Browser Binary Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是行业情报收集与分析能力，但实际代码仅执行字体下载与文件管理。代码没有任何行业数据源接入、情报采集、竞争对手资源库维护、文本分析、可信度评估或报告生成逻辑。其主要目的与声明完全不同，且实际访问的资源是字体下载站点而非行业信息源，因此属于明显的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个较完整的行业情报/竞争对手监测技能，包含多源持续采集、分类整理、评估分析和报告生成等核心能力。但代码仅实现了网页编码兼容抓取和基于HTML链接的简单新闻条目提取，没有行业领域逻辑、竞争对手资源库、持续监控、监管/政策/企业动态等分类机制，也没有任何可信度或影响力分析、摘要生成或报告输出功能。虽然“抓取网页新闻”可被视为行业情报采集的底层支撑细节，但该代码块本身的主要目的与声明存在明显差距，属于实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个行业情报采集与分析型 skill，预期能力应包括抓取/整理行业信息、维护资源库、评估可信度与影响力、生成情报报告等。代码却完全没有任何与行业、竞争对手、监管政策、媒体监测、数据采集、知识库维护或情报分析相关的逻辑。相反，它只实现了文档格式转换和 PDF 排版功能，包含本地文件访问、字体目录扫描、Markdown 解析与 PDF 生成。这属于主要目的显著不同，且实现了未声明的文档转换能力，因此描述与代码行为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个较完整的“行业情报”分析与监测能力，包含资源库建设、持续监控、多类别情报采集、可信度/影响力评估以及报告生成。代码则只提供了两个基础功能：1）访问单个指定 URL 并抓取动态渲染后的网页内容；2）从 HTML 中基于日期模式和常见标签结构粗略提取新闻标题。它没有行业领域建模、竞争对手资源库管理、分类归档、持续调度、可信度分析、影响力评分或报告生成逻辑。虽然该抓取脚本可作为行业情报系统的底层支撑组件之一，但就此代码片段本身而言，其实际行为明显窄于且不同于声明的主要用途，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个完整的“行业情报”业务技能，重点在于竞争对手资源库建设、持续监测多类情报源、信息评估和报告产出。而代码仅实现了若干网页抓取与简单提取函数：抓取动态网页、处理编码、请求雪球热帖接口、从知乎页面选择器提取内容。虽然这些抓取能力可作为行业情报收集的底层支撑，但当前代码缺少声明中的核心功能与业务逻辑，且其主要行为更接近通用/站点定制的网页采集工具，而非完整的行业情报技能。因此描述与实际行为存在明显不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 只允许对 `{SKILL_DIR}/scripts/` 目录下已存在的脚本文件进行**直接调用**。由于 cwd 通常位于工作区而非技能安装目录，调用时需使用 `{SKILL_DIR}` 前缀（请把 `{SKILL_DIR}` 替换为 `SKILL.md` 所在目录的实际路径）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 只允许对 `{SKILL_DIR}/scripts/` 目录下已存在的脚本文件进行**直接调用**。由于 cwd 通常位于工作区而非技能安装目录，调用时需使用 `{SKILL_DIR}` 前缀（请把 `{SKILL_DIR}` 替换为 `SKILL.md` 所在目录的实际路径）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 只允许对 `{SKILL_DIR}/scripts/` 目录下已存在的脚本文件进行**直接调用**。由于 cwd 通常位于工作区而非技能安装目录，调用时需使用 `{SKILL_DIR}` 前缀（请把 `{SKILL_DIR}` 替换为 `SKILL.md` 所在目录的实际路径）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 只允许对 `{SKILL_DIR}/scripts/` 目录下已存在的脚本文件进行**直接调用**。由于 cwd 通常位于工作区而非技能安装目录，调用时需使用 `{SKILL_DIR}` 前缀（请把 `{SKILL_DIR}` 替换为 `SKILL.md` 所在目录的实际路径）。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README describes PDF generation specifically as producing Chinese PDFs and repeatedly frames outputs around Chinese-language report artifacts, but does not state that users may choose another language. Because the skill targets Claude Code generally rather than a clearly China-only compliance context, this reads as a locale constraint without explicit opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad, common phrases such as '行业动态' and '政策动态', which can match ordinary conversation and cause the skill to activate when the user did not explicitly request competitive-intelligence collection. In an agent setting, unintended invocation can lead to unnecessary web access, report generation, or workspace writes, expanding the attack surface and creating confusing or privacy-impacting side effects.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares no explicit tool/permission scope despite directing use of file reads, file writes, network access, environment/path discovery, and shell execution. In a least-privilege system, this creates ambiguity about what the skill is allowed to do and increases the chance that a host grants broader capabilities than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation rules are extremely broad, triggering on many generic industry-related phrases and intents. Over-broad routing can cause this skill to activate in contexts where the user did not intend web collection, file generation, or external-source aggregation, leading to unnecessary data access and tool use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description is written as a Chinese-first invocation contract and the skill content consistently assumes Chinese-language outputs, terminology, and file naming, but it does not offer the user a language choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly documented as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to run shell commands such as interpreter discovery and direct script execution, increasing the execution surface beyond pure content analysis. Even though the file tries to constrain invocation style, normalizing shell execution in a skill expands the risk of command misuse, environmental probing, and accidental execution of unsafe helper scripts if those assets are modified or replaced.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Mandating browser automation/Playwright for dynamic pages gives the skill a substantially stronger capability than basic search/fetch. Browser automation can access richer page state, interact with navigation flows, and increase exposure to malicious web content or unintended data access compared with static retrieval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown report is written entirely in Chinese and presents itself as the skill output format, but it does not state that the language is optional or limited to a China-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file is entirely written as a skill-style output in Chinese and does not indicate that the user can choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a policy issue unless the locale limitation is explicitly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring and the code throughout the file show a standalone utility for reading arbitrary Markdown files and generating PDF output. The skill manifest describes collecting and assessing industry intelligence across seven information categories, but this file performs no intelligence gathering, analysis, credibility evaluation, or competitor tracking; it is a generic document-conversion capability instead.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language documentation and CLI help text primarily in Chinese, including the module docstring and argument descriptions. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code contains multiple natural-language strings in Chinese, including docstrings, error output, and command help text, with no indication that the tool is region-specific or that users can opt into another language. That creates a language/locale policy issue because the skill effectively forces a specific language for interaction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire report template is written in Chinese and provides no indication that users can choose another language or locale. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template is entirely written in Chinese and implicitly requires generated reports to be produced in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This markdown file documents automatic creation of an internal resource file, which is a user-data-affecting behavior. Under the markdown-file criteria for missing warnings, the description should disclose file-generation side effects more explicitly so users understand that running the skill writes artifacts to the workspace.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The markdown indicates that report files are produced in the reports directory, which affects the user's filesystem. Although the outputs are listed after execution, the skill description lacks a clear warning or notice that running it will create persistent files.
- Content
Static analysis
No suspicious patterns detected.