Security audit

Gdt Checker

Security checks for vulnerabilities and agentic risk

Overview

This is a narrowly scoped GD&T drawing-review skill with no evident hidden execution, persistence, credential use, or data exfiltration behavior.

Install this if you want a Chinese-language GD&T annotation review helper. Review its engineering output against your applicable ASME, GB, and company standards, because it explicitly provides review guidance rather than final design authority.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: 文件标题、说明、交互方式和输出描述均默认以中文呈现，且未说明可根据用户偏好切换语言，也未声明该技能仅限中文环境使用。按规则，这构成未提供用户语言/locale 选择的自然语言策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L033 的触发词同时列出“几何公差”“基准体系”“符号检查”等范围很宽的短语，这些词既可出现在一般技术讨论中，也未限定必须是请求执行本技能的语境。文档未提供负例或更明确的触发边界，因此存在误触发风险。
Content: No source excerpt is available for this finding.