Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Security audit
KnowPitch 球知
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed educational diagram generator that reads a user-created JSON file and writes an SVG, with no evidence of hidden network access, credential use, persistence, or destructive behavior.
Install this if you want a Chinese-first educational skill that generates football-formation SVG learning aids. Be aware that it runs a local Python script and writes output files, so use normal care with the input/output paths and request another language explicitly if Chinese is not desired.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The input contract states
languageis optional and the default output language is Chinese. This imposes a specific language choice on users unless they explicitly override it, which is a natural-language locale policy concern in a file otherwise presented as an English skill.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The input contract states '输出语言，默认中文', which forces a specific default language choice rather than asking the user or inheriting their preferred locale. Under the policy rule, language constraints should be user-selected or explicitly justified; no justification is given here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all user-facing examples and instructions exclusively in Chinese, which can impose a specific language on users without opt-in. The policy explicitly calls for flagging language or locale constraints unless the skill offers a choice or clearly documents a justified regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill reference is written in Chinese and does not indicate that other languages are supported or that Chinese is an intentional, region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. Line L78 explicitly requires the script to print Chinese errors, and the surrounding document is fully Chinese with no indication of user opt-in or a region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill content is written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, a fixed language can be a violation when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains extensive natural-language instructions and operational messages exclusively in Chinese, which effectively forces a specific language/locale for users. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which is present here.
- Content