Security audit

Iflytek Contract Intelligence Review

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed contract-review workflow, but users should treat sensitive contracts and generated Markdown reports carefully.

Use approved OCR, translation, and LLM providers before processing confidential contracts, avoid opening generated Markdown in viewers that allow raw HTML or remote images, and expect the current package to need fixes or injected backends before it works reliably end to end.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/processors/report_builder.py:246
Finding: Untrusted Contract Content Is Embedded in Markdown Reports Without Escaping
Content: View full analysis
Remediation: View remediation
` and neutralize Markdown constructs including links, images, headings, block quotes, emphasis markers, and code fences. 3. Prefer rendering contract excerpts as literal text in fenced code blocks. Select a fence longer than any backtick sequence present in the content, or use a renderer API that provides a dedicated plain-text node. 4. Configure the consuming Markdown renderer to: - Disable raw HTML. - Block remote images and other automatically loaded resources. - Restrict URI schemes to an explicit allowlist such as `https`. - Apply an appropriate Content Security Policy when reports are displayed in a browser. 5. Keep presentation fields separate from untrusted document content rather than constructing reports through unrestricted string interpolation. 6. Add regression tests using payloads containing: - Raw HTML image elements - Markdown image and hyperlink syntax - Heading and block-quote markers - Backticks and nested code fences - Encoded HTML entities - Potentially dangerous URI schemes ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch. The declared description promises a full contract-audit workflow with OCR, legal/risk analysis, compliance checks, and bilingual handling. However, the supplied code chunk is only an empty Python package initializer (scripts/clients/__init__.py) with a comment and no executable logic. Based on this code alone, the skill does not implement or expose any of the declared capabilities. This is a materially different actual behavior from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose promises a comprehensive contract auditing capability, including OCR, legal clause analysis, risk detection, compliance review, and bilingual processing. However, the supplied code chunk does not perform any contract-specific analysis at all. It only defines base classes and placeholder methods for generic image understanding and element extraction, and the default implementation raises NotImplementedError rather than executing real logic. While image understanding could be a supporting component for reviewing scanned contracts, this code chunk by itself materially differs from the declared primary purpose and does not implement the advertised contract-review capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a complete contract intelligence review system spanning OCR, clause analysis, risk detection, compliance checks, and translation/summary. The supplied code chunk does relate to contract review conceptually, but it is only an abstract LLM client interface plus placeholder methods that raise NotImplementedError. Its actual implemented behavior is limited to defining result schemas, method signatures, and logging. Because several prominent advertised capabilities—especially OCR, image/scanned document support, bilingual handling/translation, and a working full review pipeline—are not present in the code, the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: There is a clear description-behavior mismatch. The description claims a complete contract intelligent audit pipeline, including OCR, clause analysis, risk detection, compliance review, and translation summary. However, the code chunk is limited to OCR client abstractions and a placeholder implementation. Its primary purpose is to define interfaces for future OCR integration, not to perform contract review. This is a material underimplementation of the declared behavior, and the code shown does not support the broader legal/compliance capabilities described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the rich declared purpose and the provided code. The code chunk is effectively empty aside from a comment marking a processors package, so it does not demonstrate any of the advertised capabilities. Because the actual supplied code has no functional behavior related to contract auditing, the description is not accurately represented by this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises an end-to-end contract auditing capability, including OCR for scans/images, clause analysis, risk detection, compliance review, and translation summary. The supplied code chunk is much narrower: it only checks Chinese/English bilingual consistency by aligning clauses and identifying missing translations, simple numeric/date mismatches, and count-format inconsistencies. This is not an undeclared extra capability; rather, the description substantially overstates the implemented functionality and its primary purpose. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a comprehensive contract-audit pipeline, including OCR, clause analysis, risk detection, compliance review, and bilingual/translation support. However, this code chunk only performs low-level text preprocessing on already-available text. While OCR-error correction and text normalization could be a supporting component of such a system, the actual code does not implement the core declared functions. Therefore the code chunk’s behavior is materially narrower and different from the declared purpose, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Yes, there is a clear mismatch. The declared description promises a full contract intelligence review workflow, but the provided code chunk does not perform any substantive behavior at all—it is only an empty/prompts package initializer. Based on this code alone, none of the advertised capabilities are implemented or evidenced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The description promises a full contract auditing pipeline with OCR, legal clause analysis, risk detection, compliance checking, and bilingual/translation support. However, the only provided code is an empty __init__.py file with no executable logic beyond a comment. This means the supplied code does not demonstrate or implement the declared primary purpose or any of the listed capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared purpose and the actual code. The description claims a full contract-audit pipeline with OCR, legal analysis, risk/compliance detection, and bilingual processing. However, the provided code contains only a reusable logger helper and mixin, with no contract-processing logic, document parsing, OCR, NLP, compliance rules, or review workflow. While logging can be a supporting utility inside a larger skill, this chunk by itself does not implement or substantively contribute enough to the declared primary purpose. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/processors/risk_detector.py (reported line 216)May include surrounding context.
python
), ] } return rules def detect( self,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly describes routing contract content to external OCR, translation, and LLM services but does not warn users that sensitive legal documents may be transmitted to third-party endpoints. In a contract-review skill, documents commonly contain confidential, personal, financial, or trade-secret information, so omission of a privacy/data-sharing warning can lead to unintended disclosure and compliance violations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises use of environment-provided OCR/LLM backends and file I/O behavior but does not declare an explicit tool/permission scope. That creates an avoidable least-privilege gap: the runtime may grant broader access than reviewers or users expect, increasing the blast radius if the skill or its dependencies are compromised or behave unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is entirely written in Chinese and explicitly labels the document language as "zh," but it does not indicate that the user selected or opted into that locale. The policy requires flagging language or locale constraints when a specific language is imposed without user choice or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file’s natural-language interface elements, including module documentation and exception messages, are entirely in Chinese. Because the skill does not offer a user language choice or document that it is intentionally limited to a Chinese-language environment, it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring presents the skill description only in Chinese, and the rest of the file continues this pattern for docstrings and operational messages. Under the language/locale policy, forcing a single language without user opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The logger output and NotImplementedError messages are user-visible text and are all written only in Chinese. Because the file does not offer localization, configuration, or any documented language constraint, this creates a policy violation for language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code hard-codes target_lang: str = "zh" for summary translation, which imposes a specific language choice by default. That is a natural-language locale policy concern because users are not offered an explicit opt-in or choice before Chinese is selected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code sends contract files to external OCR and image-understanding services during normal processing, but the workflow shown here does not present any explicit user consent, disclosure, or policy gate before transmitting potentially highly sensitive legal documents. Because contracts often contain confidential commercial terms, personal data, and regulated information, silent third-party transmission creates a real privacy and confidentiality risk rather than a merely theoretical issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The translation summary step transmits cleaned contract text to an external translation client with no visible warning, consent prompt, or sensitivity check. In the context of contract review, this is especially dangerous because even partial text or summaries can expose confidential clauses, pricing, counterparty identities, or other legally sensitive content to third parties.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code file contains user-facing natural-language descriptions such as the module and class docstrings only in Chinese. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless the constraint is explicitly justified or alternatives are offered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file contains natural-language documentation that assumes Chinese as the required language for understanding the skill's purpose and behavior. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language module and class documentation in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module docstrings and all user-facing report strings are hard-coded in Chinese, including report headings and summaries. This indicates a fixed language behavior without any visible opt-in, language selection, or documented justification for restricting output to a specific locale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The class defines an instance method generate_summary and later redefines the same name as a @staticmethod. In Python, the later definition replaces the earlier one, so builder.generate_summary(result) inside the static method resolves back to the same static method and recurses indefinitely, causing a runtime failure or denial of service when summary generation is invoked.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.