Cn Text Summary

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.2.7

Overview

This is a small local Chinese text summarizer with disclosed optional keyword extraction and no evidence of network access, persistence, credential use, or destructive behavior.

Reasonable to install for non-sensitive Chinese text summarization. Prefer a pinned jieba version if installing the optional dependency, and avoid sending confidential documents through command-line arguments; use a safer wrapper or stdin-based version for private text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text - jieba (pip install jieba) - Chinese word segmentation only ``` The original documentation instructs users to execute `pip install jieba` without specifying a version, package hash, lockfile, or trusted package index. ### Technical Analysis Installing an unpinned dependency causes the package manager to resolve whichever release is current at installation time. Consequently, the installed code may differ from the version reviewed during the Skill audit. Python packages can execute code during installation and whenever imported. This script imports both `jieba` and `jieba.analyse` at startup. If the upstream project, maintainer account, release process, or package repository were compromised, a malicious release could execute with the privileges of the user running the installation or Skill. No evidence indicates that the current `jieba` package is malicious. The vulnerability is the absence of dependency integrity and reproducibility controls. ### Attack Path 1. An attacker compromises the upstream package, a maintainer account, or the package publication process. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user follows the documented unversioned `pip install jieba` instruction. 4. The package manager resolves and installs the compromised release. 5. Malicious code executes during installation or when `text_summary.py` imports `jieba`. 6. The payload obtains the same filesystem, process, and network privileges as the affected user. ### Impact Assessment Successful exploitation could result in arbitrary Python code execution under the installing or executing user's account. The reachable scope could include that user's files, environment variables, accessible credentials, network access, and any resources available to the surround ...[truncated 92 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `jieba` to a specific, reviewed version rather than installing the latest release. 2. Record dependencies in a version-controlled requirements or lock file. 3. Require package integrity hashes, for example with `pip install --require-hashes`. 4. Configure an explicitly trusted package index and prevent unexpected fallback to untrusted indexes. 5. Periodically review and deliberately update the pinned version after security testing. 6. Correct the documentation to reference the actual script path and provide a reproducible installation command. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/text_summary.py:64
• Finding: Sensitive Source Text Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/text_summary.py`, lines 64–69 **Vulnerability Type**: Sensitive data exposure through command-line arguments **Risk Level**: Low ### Vulnerable Code ```python def main(): if len(sys.argv) < 2: print(json.dumps({'error': 'Please provide text content'}, ensure_ascii=False)) return text = sys.argv[1] ``` The displayed English error message is a translation of the source literal; the vulnerable operation is the assignment of the complete first command-line argument to `text`. ### Technical Analysis The program accepts the entire document to be summarized through `sys.argv[1]`. Command-line arguments are not an appropriate transport for confidential data because they can be exposed through shell history, process inspection facilities, audit systems, job schedulers, crash reports, orchestration metadata, and command telemetry. The application does not transmit the text over a network or persist it directly. Exposure instead occurs through the operating environment before or while the process reads the argument. Exploitation generally requires local access, access to operational logs, or access to process-monitoring infrastructure. ### Attack Path 1. A user invokes the script with a confidential document as the first command-line argument. 2. The shell, scheduler, audit subsystem, process monitor, or orchestration platform records or exposes the command line. 3. A local user or operator with permission to inspect the relevant process information or logs retrieves the argument. 4. The observer obtains the confidential source text even though the summarization code itself performs no network transmission. ### Impact Assessment The impact is disclosure of the complete input document. Depending on its contents, this could expose personal information, proprietary documents, credentials embedded in text, internal communications, or regulated data. This issue does not provide ...[truncated 254 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read source text from standard input by default so document contents do not appear in the process command line. 2. Optionally support a file path, while requiring callers to protect the file with restrictive permissions. 3. Reserve command-line arguments for non-sensitive configuration such as summary length. 4. Document safe usage, for example: ```bash python3 scripts/text_summary.py < private-document.txt ``` 5. Avoid logging raw input and ensure surrounding wrappers, schedulers, and telemetry systems do not capture document contents. 6. If file input is supported, validate paths and avoid creating plaintext temporary copies. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The primary purpose broadly matches: the script accepts text and produces a summary. However, the description specifically claims '纯Python标准库' (pure Python standard library), which is inaccurate because the code attempts to import and use the external jieba package for keyword extraction. Although it can fall back to a standard-library-only approach if jieba is missing, the implemented behavior is not strictly standard-library-only. Additionally, the script also extracts keywords and includes them in the output, which is an extra user-visible capability not reflected in the declared description. No evidence of API key use, network access, or other risky undeclared permissions was found.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest name, description, title, and usage guidance are entirely in Chinese, and the dependency note explicitly states Chinese tokenization support. This indicates a language-specific constraint, but the file does not state that the skill is Chinese-only, offer an opt-in language choice, or justify the locale restriction as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code’s natural-language description, docstrings, and error output are entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. The stated policy flags language or locale requirements unless the skill offers a choice or clearly documents a justified region-specific constraint.

Static analysis

No suspicious patterns detected.