Security audit

周末去哪玩｜只推一个

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language weekend outing decision skill with bounded public web use and explicit limits against login, scraping, posting, or saving sensitive data.

Install this if you want a Chinese-language assistant that makes a single weekend outing recommendation using public evidence. Grant only the public browsing/search and optional memory access needed for that purpose, do not provide platform logins, and re-check weather, opening hours, tickets, and return transport before going out.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for an end-user decision-making travel skill that should analyze trip factors and choose a single outing recommendation. The supplied code does not perform any travel planning, date resolution, candidate selection, weather/traffic/business-hour analysis, or recommendation generation. Instead, it is an evaluation script used to check whether some output text conforms to predefined rules. This is a materially different primary purpose and capability set, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a consumer-facing travel decision skill that selects a single outing recommendation for today/this weekend. The supplied code does nothing related to travel planning, date resolution, weather, budget, nearby destinations, or recommendation generation. Instead, it is an internal evaluation script for scoring agent outputs against test cases stored on disk. This is a materially different primary purpose and capability set, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user travel recommendation skill, but the supplied code does not perform any travel, date interpretation for outings, candidate evaluation, weather/crowd/business-hour checks, or recommendation generation. Instead, it is a packaging utility for creating release ZIP files and manifest metadata. This is a materially different primary purpose and introduces undeclared filesystem/archive management capabilities unrelated to the described skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an end-user travel recommendation/outing selection skill. The supplied code does not implement travel planning, date resolution, candidate selection, weather/crowding/business-hour checks, or recommendation generation. Instead, it is an internal testing utility that validates precomputed outputs against curated test cases. This is a materially different primary purpose and capability set from the declared skill behavior, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a travel-planning/outing-selection skill, but the supplied code is an internal engineering script for running release checks. It parses command-line arguments, invokes other scripts, captures stdout/stderr, aggregates pass/fail statuses, and exits based on test outcomes. There is no logic for interpreting dates, destinations, weather, budget, transport, crowds, or recommending places to go. This is a clear primary-purpose and capability mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for an end-user travel/leisure recommendation skill that should decide where to go this weekend or today. The supplied code does not perform recommendation, ranking, itinerary selection, or user-context reasoning. Instead, it validates the structure and recency of a JSON 'live evidence' file, ensuring required fields exist and that source types include weather, official, and transport references. While these checks may support a larger outing-planning system, this code chunk's actual primary purpose is internal evidence validation, which is materially different from the declared user-facing behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file content is written as mandatory Chinese interaction patterns and output templates, with no indication that language should follow the user's preference. For users interacting in another language, this can override expected behavior, degrade comprehension of safety caveats and verification steps, and make the system less reliable or accessible.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest description and visible skill heading are entirely in Chinese and present the skill as operating in that language, but the file does not state that language is optional or user-selectable. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language instructions are entirely in Chinese and do not indicate that the user may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s operational instructions are entirely written in Chinese, with no indication that the skill supports other languages or that Chinese is a documented, justified locale requirement. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to enter candidate-decision mode whenever a user provides 3–5 place names or links is broad and can activate on ambiguous travel-related messages without clearly gating for user intent, geography, or decision scope. This can cause the agent to apply the wrong skill, skip needed clarification, and produce overconfident recommendations based on incomplete constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill specification is written only in Chinese and includes fixed Chinese output text for the assistant to use, such as the mandated phrasing in the output examples. This imposes a specific language/locale behavior without any documented user choice, opt-in, or justification for restricting the skill to Chinese users only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The display name, short description, and default prompt are all written exclusively in Chinese, with no indication that the user can choose another language or locale. This creates a natural-language policy concern because the skill appears to impose a specific language experience by default rather than offering language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example content is entirely in Chinese and presents the skill as operating in Chinese without any indication that the user can choose another language. This can exclude users, cause mismatches with user language expectations, and lead downstream agents to respond in a language the user did not request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents the entire user interaction and expected output exclusively in Chinese, with no indication that language selection is optional or user-driven. This can violate a language/locale policy when a skill implicitly requires a specific language without documented opt-in or regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown example is entirely framed in Chinese and presents the interaction/output format as fixed, with no indication that the user can choose another language. That can violate language/locale policy when a skill implicitly mandates a specific language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction requires the body to use Chinese weekday formatting such as 周六（2026-07-18） and explicitly forbids an alternative date rendering. This is a natural-language locale constraint, and the file does not provide any user choice or justification for enforcing Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document is written as a directive in Chinese and instructs how the final answer should be framed, but it does not provide any user opt-in or alternative language option. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s operational instructions are written in Chinese and direct the skill behavior in that language, but there is no indication that the user can choose another language or that the skill is explicitly limited to a Chinese-language context. This is a natural-language locale policy concern because it imposes a language constraint without opt-in or justification in the file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are extremely common conversational expressions like “随便”“都行”“你决定”, which can appear in many contexts unrelated to weekend trip selection. This can cause unintended skill activation, leading the agent to override user intent or route requests into the wrong decision workflow, especially because the skill is designed to make a single decisive recommendation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill specifies all operational instructions and user-facing phrasing in Chinese only. The policy requires flagging language or locale constraints when the skill forces a specific language without giving the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The policy content is written to enforce Chinese-only outward phrasing and does not indicate any user-selectable language behavior or a justified locale restriction. This can cause the skill to ignore user language preferences, reducing usability and potentially leading to misunderstanding of travel-safety guidance, though it is not a direct code-execution or data-security issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructions and report template are entirely written in Chinese, which imposes a specific language on users without offering a choice or explaining a region-specific requirement. The policy allows locale constraints only when users can opt in or when the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill guidance is written in Chinese and provides no indication that language choice is optional or user-driven. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.