Security audit

AI Summary Ope Page V2

Security checks for vulnerabilities and agentic risk

Overview

This skill’s document-summary workflow is appropriately scoped, but its automated fact checks still need human review.

Use it for Russian, Sber-focused summaries and check quotations, chart values and source pages before circulation. Output may exceed one page. For confidential reports, decline web search and preload OCR models or block runtime network access. Purge retained working copies when finished.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The primary purpose matches, and the filesystem operations and rendering are supporting implementation details. The mismatch concerns explicit output and verification guarantees: cmd_build marks multi-page output deliverable through ready_as_is; FC_EXTRA_ROUNDS allows mandatory claims to undergo five rounds; and verify_numbers does not consistently require page-specific numeric support. Citation-validation internals and internet-consent enforcement reside in modules not supplied, so their behavior cannot be confirmed from this chunk. No unrelated resource access or exfiltration is evident.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

The promised verbatim quotation check accepts quotations assembled by omitting ordinary page words.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The fallback matcher accepts noncontiguous words without requiring visible ellipses, relying on an incomplete blacklist to prevent meaning-changing omissions. For example, it can accept “Revenue grew” from “Revenue fell; profit grew,” allowing fabricated evidence to pass the quotation check. Model-based semantic review mitigates this risk but does not restore the promised verbatim guarantee, particularly for summaries intended for board decisions.
Content: No source excerpt is available for this finding.

Image-fact evidence bypasses the document-page verification promised by the manifest.

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: An evidence reference to any registry fact marked from_image is accepted without checking its page, verification status, or correspondence to the source image. Its stored numbers and quotation then become trusted evidence for numerical validation, so an incorrect or manipulated registry entry can substantiate an unsupported claim. This undermines report integrity in a decision-sensitive workflow, although the shown code does not establish an execution or exfiltration vulnerability.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

L017–L020 require fact claims and modality descriptions to be written in Russian without offering a language choice.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The field instructions explicitly require Russian for both claim and modality. This imposes a specific output language without user opt-in or a documented locale-specific justification; the issue is the explicit requirement, not the use of Russian elsewhere in the code.
Content: No source excerpt is available for this finding.

Caller-controlled from_image flag bypasses the promised automatic numeric verification.

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: Caller-controlled from_image suppresses rejection of numbers absent from the referenced page without requiring evidence of visual verification. Its use of bool() also treats strings such as "false" as true, allowing accidental or adversarial acceptance of unsupported numeric facts. Supporting chart extraction is legitimate, but accepting these facts into a registry used for board summaries weakens integrity; downstream summary checks are not shown here and may mitigate the final impact.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Fact-generation instructions require Russian output without offering a language choice.

Medium

Category: Output Handling
Confidence: 92% confidence
Finding: L0081–L0083 explicitly require the claim field to be written in Russian, and these instructions are included in generated prompts through render_rules. Although the intended reader is a Russian company's board, the file does not offer language opt-in or explain why Russian output must be mandatory rather than a configurable default.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

L0312–L0313 require translation into Russian without user language opt-in.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The validation error labels English text as untranslated and explicitly instructs the agent to translate it into Russian, allowing only names and abbreviations in Latin script. This imposes a specific output language without offering a language choice; the Sberbank-focused context does not explicitly justify a Russian-only language constraint.
Content: No source excerpt is available for this finding.

The workflow permits a multi-page final deliverable despite the manifest’s one-page summary promise (L280–L283).

Low

Category: Excessive Agency
Confidence: 98% confidence
Finding: The manifest describes a one-page A4 summary, but these instructions explicitly allow an oversized summary to be delivered as ready_as_is after five unsuccessful shortening attempts. This creates an exception to a defining output constraint without requiring user approval or disclosing the exception in the manifest.
Content: No source excerpt is available for this finding.

The skill can finalize and deliver a multi-page summary despite its manifest promising a one-page A4 summary.

Low

Category: Excessive Agency
Confidence: 100% confidence
Finding: At L1422, a fact-checked summary spanning multiple pages receives the verdict ready_as_is, which L1438 treats as a final deliverable. The instructions at L1478–L1482 explicitly tell the agent to send that PDF unchanged, merely notifying the user of its length, rather than enforcing the manifest's one-page requirement or obtaining approval for an exception.
Content: No source excerpt is available for this finding.