Security audit

生产隐患排查技能

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local hazard-inspection record tool, with no evidence of hidden network access, credential use, or deceptive behavior.

Install only if a local Chinese-language JSON-based inspection tracker is appropriate. Keep backups of ./inspection_data/, avoid running multiple update commands at the same time, and do not rely on it as a complete compliance assessment system without human review.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_inspection.py:20
Finding: Non-Atomic File Updates Can Corrupt or Overwrite Safety Records
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是一个较完整的隐患排查与整改跟踪系统，包含检查、录入、任务管理、统计分析和合规评估等多项能力。而实际代码是一个离线分析脚本，唯一明确实现的是对 inspections.json 和 remediations.json 中现有数据进行统计汇总与趋势分析。它不创建、更新或跟踪整改任务，不执行安全检查流程，不提供隐患录入，也没有任何合规性规则评估逻辑。因此代码只覆盖声明中的“统计分析”一部分，整体用途明显比声明狭窄，属于描述与实际行为不一致。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents file-reading and file-writing behavior via local scripts and a persistent ./inspection_data/ directory, but it does not declare any permissions or allowed-tools scope. That creates an authorization and transparency gap: an agent may access or modify local files without explicit boundaries, which can lead to unintended data exposure or tampering in environments that rely on manifest-declared capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L017 将触发条件概括为“日常安全巡检、隐患上报、整改跟踪、定期安全报告生成”，这些是高层业务场景而非具体、可判定的触发短语或约束条件，难以区分技能何时应激活、何时不应激活。文档中也未给出负例、限定上下文或更精确的调用入口，容易导致在广泛安全管理语境下被误触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file contains its module docstring, argument descriptions, validation errors, and success messages entirely in Chinese, which imposes a specific language on users. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and user-facing CLI descriptions are entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: L139 明确写明“支持中文交互”，在当前文档中未同时说明是否支持其他语言、是否允许用户自行选择语言，可能构成默认语言/locale 限制。根据规则，若未提供用户语言选择或明确的合理地域限定，属于自然语言层面的策略风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all instructions, checklist items, and usage guidance exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, function docstrings, status messages, and argument help text are written only in Chinese, which imposes a specific language on users of the skill. The file does not offer any language selection or explain that the tool is intentionally limited to a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions and CLI help text that appear to require Chinese, starting with the module docstring and continuing throughout the script. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The argparse description, subcommand help, and argument help are all presented only in Chinese. Because the file does not offer an alternate language or explicit locale opt-in, this conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.