政策影响链

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 12:56 AM UTC
• Version: 0.1.0

Overview

The skill fits its policy-document task, with disclosed optional online services and a checker that still requires human verification.

Use directly supplied public text if you do not need the online integrations. Before enabling them, verify credential destinations and the provider's document-handling terms; avoid sending confidential attachments without authorization. Review installer and dependency revisions. Check every retained chain against its source even when the bundled checker passes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk performs service diagnostics rather than policy-document analysis. It does not retrieve a policy document, extract or anchor provisions, identify dates, or generate the declared five-section output. Although service discovery could support a larger workflow, this chunk establishes no connection between the queried service and the declared policy-analysis task. No credential exfiltration is established; the bearer-key use is an authentication operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk tests catalog accessibility and whether a routing endpoint accepts an API key. It does not retrieve or analyze a policy document, extract source-anchored provisions or dates, or generate the declared five-section output. Although service discovery could support a larger implementation, this chunk provides no connection between these connectivity checks and the declared policy-analysis workflow. Its demonstrated purpose is MCP endpoint discovery and authentication testing, materially different from the stated purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash

# 1. drop it into the skills directory
mkdir -p ~/.workbuddy/skills
cp -r policy-impact-cn ~/.workbuddy/skills/

# 2. ask the agent for the five-section card defined in SKILL.md and save it as my-policy-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r policy-impact-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的政策卡五段出卡，产物存成我的政策链卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command runs an unpinned npm CLI and installs skill content from a mutable repository reference. A compromised release or repository update could introduce code or agent instructions with the user's privileges; this is a supply-chain risk, not evidence of an already malicious package.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The optional dependency setup executes an unpinned npm CLI and selects skills from a mutable repository. Upstream compromise could therefore introduce executable code or persistent agent instructions, although installation is explicitly optional.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Selecting a specific skill limits installation breadth but does not pin either the npm installer or the selected skill's repository revision. A future compromised upstream version could execute code or alter the agent's behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Authenticated tools/list discovery is legitimate, but the command sends the API key to a URL taken from a live catalog without a stated destination-validation step. A compromised catalog or manipulated routing value could redirect the credential to an attacker-controlled endpoint or an insecure HTTP destination.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take the domain's routing.url and transport from that response; do not copy the host into a config by hand

3) with a key, send tools/list — proves only that this data-leg endpoint accepts the key, and proves nothing about other entries

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The workflow directs users to start third-party document parsing without warning that document contents may leave the local environment.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The troubleshooting guidance encourages enabling external parsing without explaining that attachments may be transferred to a third party. Public policy documents reduce the typical sensitivity, but user-supplied documents could contain confidential annotations or unpublished material.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command executes an unpinned npm installer and installs skill content from a mutable upstream repository. A compromised upstream release could introduce code or agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The optional dependency installation uses both an unpinned npm CLI and a mutable skill collection. This creates a supply-chain exposure to future compromised code or instructions, even though the user can skip installation.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The single-skill selector does not make the installer or selected repository content immutable. Upstream compromise could change the installed behavior without any change to this documented command.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The diagnostic request sends a bearer credential to a destination derived from live catalog data without requiring independent origin or HTTPS validation. Although authentication is expected for this service, a compromised routing response could cause credential disclosure.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The attachment-parsing workflow lacks a privacy warning about sending document content to an external service.

Medium

• Category: Output Handling
• Confidence: 89% confidence

Finding

The workflow permits sending long documents and attachments to an external parsing service without an explicit privacy warning or approval requirement. Parsing only when an attachment contains needed evidence reduces volume, but does not protect confidential user-supplied content from unintended disclosure.

Content

No source excerpt is available for this finding.

L071 exempts candidate-chain lines containing “未检索到” from all evidence checks, contradicting the documented mandatory grounding requirement.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Any occurrence of 未检索到 on a candidate-chain line disables all of that line's evidence checks, even when it still asserts concrete stages. An unsupported chain can therefore pass the advertised gate by including this marker, undermining the skill's central grounding requirement without requiring code execution.

Content

No source excerpt is available for this finding.