Security audit

标准语料分类器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local PDF organizer and report generator, with file-moving behavior that is expected for its purpose and controlled by the user.

Install only if you want an agent to organize a folder of standards PDFs. Run the classifier with --dry first, and point CORPUS_DIR at the intended corpus folder because the non-dry command moves matching PDFs into categorized subfolders. Review any newly discovered source URLs before writing them into sources.json.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Static analysis

No suspicious patterns detected.