Security audit

China Consumer Electronics Suppliers

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only China electronics sourcing guide with a disclosure mismatch around supplier contact emails, but no evidence of unsafe execution, data access, or persistence.

Install this only if you want China-focused consumer-electronics supplier research. Treat the supplier contact emails and market figures as data to verify independently before outreach, especially because the package under-discloses the individual contact list. The reviewed code does not request sensitive access or make changes to your environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill says users can interact using natural language and then provides only broad example prompts without defining specific trigger constraints or exclusion conditions. For a markdown skill description, this makes activation scope ambiguous and overlaps with ordinary supplier-research questions a user might ask generally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest frames the skill as a guide providing information about manufacturing clusters, supply chain structure, regional specialization, and industry trends. The factories section goes further by listing direct business contact emails for named companies, which turns the dataset into a supplier contact directory and outreach aid rather than just an industry guide.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The dataset title and summary explicitly scope the content to China, and the rest of the file consistently centers Chinese industry sources and regions. For a general skill data file, this creates a locale-specific constraint without any accompanying opt-in, user choice, or documented justification that the skill is intended only for China-focused use.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest specifically claims coverage of smartphone, wearable, audio, smart home, and AR/VR manufacturing clusters. Several factory entries extend beyond that scope into refrigerators, air conditioners, drones, surveillance systems, routers, laptops, projectors, motherboards, and semiconductor packaging, which broadens the skill into general electronics and adjacent sectors.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The top-level description hard-codes the skill as focused on "China consumer electronics" and sourcing guidance, which is a locale/country constraint expressed in natural language. Because the file does not indicate that this regional focus is optional or user-selectable, it may conflict with a language/locale policy requiring opt-in unless this regional limitation is separately justified by the broader skill context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.