other
Warning
- Location
scripts/auto_discover.py:15- Finding
Out-of-Scope Source Discovery and Persistent Configuration Mutation
- Content
View full analysis
- Remediation
View remediation
Security audit
federal-immigration-expert
Security checks for vulnerabilities and agentic risk
Overview
The skill is not a backdoor, but it overstates live federal-only accuracy while using offline estimates and persistent monitoring that can add non-federal sources.
Review this skill before installing if you need reliable immigration guidance. It may fetch public policy pages, run scheduled monitoring, and write local source/hash files; disable or review auto_discover.py and cron monitoring if you want federal IRCC-only behavior. Treat CRS and eligibility output as an estimate and verify against current official IRCC sources or a qualified professional before acting on it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a live federal immigration policy expert that evaluates candidates across Express Entry streams and computes CRS scores from official sources. This code chunk only performs automatic discovery of additional source URLs from predefined seed pages and stores them in data/sources.json. While fetching official immigration-related pages can be a supporting component of a live-policy system, this specific chunk’s primary behavior is materially narrower and different: it is a crawler/registry updater, not an eligibility/scoring engine. It also targets Ontario provincial nominee content and a Sudbury newcomer page, which extends beyond the declared generic federal IRCC Express Entry focus.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The main functional domain matches immigration scoring and eligibility assessment, but key declared capabilities are not implemented. The description explicitly promises real-time retrieval from official sources, update detection, and decisions based on live official sources rather than stale offline data. The code instead states it is local/offline ("不联网"), uses hardcoded scoring tables and logic, references static snapshot files, and even notes that the CRS is an estimate/approximation with incomplete factors. Therefore the description materially overstates how current, live, and authoritative the skill is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The code’s behavior is much narrower than the declared description. It does perform one supporting aspect of the description—monitoring watched web pages for content changes—but it does not implement the core promised capabilities: immigration policy expertise, candidate eligibility determination across streams, CRS calculation, or itemized scoring. It also reads arbitrary URLs from a local configuration file rather than specifically enforcing official IRCC sources. Therefore the declared purpose materially overstates and misrepresents what this code chunk actually does.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code is plainly an offline calculator using hardcoded logic and comments referencing local snapshot files, while the skill metadata promises live official-source fetching and update detection. In an immigration-advice context, this mismatch can mislead users into trusting stale or incomplete policy determinations for legal/eligibility decisions, creating a serious integrity and safety issue.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README makes materially inconsistent security-relevant claims: it says the skill is fully local and requires no network, while also claiming real-time official-source judgments and daily policy monitoring. This can mislead users or platform operators about whether outbound network access occurs, weakening informed consent, sandboxing decisions, and trust boundaries around the skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares tools with network access and describes writing snapshots and hashes, running monitoring scripts, and updating local registries, but it does not define any explicit tool scope restrictions such as allowed-tools or permissions. This creates an avoidable expansion of capability where the skill can perform broader network or local-write actions than a reviewer or caller might expect.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says policy judgments 'follow live official sources, never stale offline data.' However, later documentation states snapshots are stored locally for diffing and that official snapshot files are kept 'for offline fallback and evaluation basis.' That is a direct behavior mismatch at the skill-description level because offline cached data is part of the documented operating model.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill's operative instructions and behavior description are presented only in Chinese, which effectively forces a specific language for users or maintainers without any stated opt-in. The policy-violation category applies because this is a natural-language locale constraint and the file does not explain that the skill is intentionally region- or language-limited.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Line L09 says all policy conclusions must be based on real-time official authoritative sources and that offline rules are considered possibly outdated. But L70-L71 explicitly document locally captured official snapshots used 'for offline fallback and evaluation basis.' That is an active contradiction between the stated intent and the documented behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON file includes multiple human-readable
namevalues containing Chinese text alongside English labels, but the file provides no indication that multilingual or Chinese-specific output is optional, user-selected, or region-specific. Under the policy criteria, forcing or embedding a specific language/locale in natural-language content without opt-in can be a language/locale policy violation.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module claims to discover 'official policy sources,' but one configured source is a municipal/community site rather than an official federal policy authority. In a skill that promises live official-source policy judgments, this misleading framing increases the risk that lower-authority or derivative content will be treated as authoritative, producing unsafe legal/policy guidance.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The discovery scope includes Ontario provincial and Sudbury community sources even though the skill is described as a federal immigration expert focused on IRCC policy. This creates a trust-boundary and provenance problem: downstream policy judgments may silently incorporate non-federal rules or guidance, leading to incorrect eligibility or CRS-related advice presented as federal policy.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The docstring claims complete CRS 1200 scoring, but the implementation only estimates a subset of factors and later admits the result is approximate. This can cause users to overtrust precision and completeness in a high-stakes legal workflow, leading to incorrect self-assessment or application planning.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language descriptions entirely in Chinese in the module docstring, and later prints Chinese-only user-facing messages. For a general-purpose evaluator that accepts input for "任意候选人", this imposes a specific language/locale without documenting that constraint or giving users a choice, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The main program prints headings, notes, warnings, and final guidance only in Chinese, with no mechanism for users to select another language. Because this is a natural-language constraint in user-visible strings, it is a policy concern under the locale-choice requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The phrase "A generic Canadian federal immigration policy assistant" imposes a specific national/legal locale in natural language. Under the policy rule, locale constraints should be clearly documented and justified as region-specific; here the scope is implied but not explicitly framed as a Canada-only tool for users seeking Canadian immigration guidance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This plain-text skill content states that language requirements must be met on approved English/French tests, which encodes a specific language policy in natural language. The file does not present this as an optional user choice or opt-in, so it matches the policy-violation category for forced language or locale constraints.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest says policy judgments follow live official sources and not stale offline data, which suggests a read/fetch-oriented design. This script persists discovered links into data/sources.json, creating and updating local state that is not reflected in the manifest description and can become stale unless separately maintained.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs a file write that changes the skill's persistent source list, but the save function itself has no user-facing warning, confirmation, or inline comment explaining that local data will be modified. Although the module docstring mentions collecting links into data/sources.json, the write operation is silent at execution time until after changes are already made.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code presents its primary description in Chinese and emits fixed operational strings without any mechanism for language selection or user opt-in. That can violate a language/locale policy when skills are expected to be language-neutral or user-selectable.
- Content