Security audit

监管最新动态追踪（金融监管总局、证监会、央行）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a public regulatory-news crawler with some documentation inaccuracies, but I found no hidden persistence, credential access, destructive behavior, or unrelated data collection.

Before installing, understand that the skill will make web requests to Chinese financial regulator sites and may print or save full public article text and attachment links before summarizing. Use a virtual environment, avoid running pip or the crawler as an administrator, and treat the Word-output and broad coverage claims as overstated unless the skill is updated.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 整体上，代码的核心用途与声明大体一致：它确实监控并抓取中国金融监管机构官网的最新监管动态，来源站点也与声明匹配，没有发现明显的越权、无关资源访问或恶意附加能力。但描述存在若干实质性不准确之处。第一，声明称“支持Word和纯文本”，而代码只有 --output 参数将结果写入普通文本文件，没有任何 .doc/.docx 生成逻辑或 Word 库调用。第二，声明称以“标题+摘要格式输出”，但 format_output 实际输出的是标题、日期、链接，以及 full_content 完整正文；NFRA 虽抓到 summary 字段，但最终并未使用。第三，声明列出“通知公告、风险提示”等覆盖范围，但代码中具体频道只实现了 NFRA 的政策规章/行政处罚/征求意见，CSRC 的监管规定/行政处罚，PBOC 的条法司法规规章与北京分行行政处罚，未见专门的通知公告或风险提示栏目抓取。因此应判定为描述与实际行为部分不符，属于中高置信度的能力描述夸大/不准确，而非完全不同用途。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of a networked crawler and mentions output support beyond plain chat, but it does not declare any explicit tool scope or permissions boundaries. That creates a governance gap: an agent may invoke network access or write files without transparent restriction, increasing the chance of overbroad data access or unintended side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates activation for broad, generic regulatory-news queries, which can override normal intent routing and user choice. Overbroad triggering increases the risk of unnecessary network access, incorrect tool invocation, and prompt-surface expansion when a simpler answer or different skill would be more appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language description is entirely prescriptive in Chinese and requires use of this skill for matching requests, but it does not offer any language or locale choice to the user. Under the stated policy, forcing a specific language or locale without opt-in is a policy violation unless clearly justified and documented.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The output routine includes full article bodies and attachment URLs, while the skill description promises a title-plus-summary style result. This can cause unintended over-disclosure of scraped content, including potentially sensitive enforcement details or direct links to downloadable files, and it expands the data surfaced to downstream consumers beyond the declared behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest broadly claims monitoring of PBOC for policies, penalties, notices, and risk alerts, but the implemented PBOC channels are limited to three 条法司 policy pages and one Beijing branch administrative penalty page. There is no implementation for broader central-bank notices, announcements, or risk alerts, so the actual coverage is materially narrower than described.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.