Security audit

Mingshu Classifier

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently scans a user-selected directory to classify privacy-sensitive files and optionally writes reports, with disclosed but non-zero handling risks.

Install only if you are comfortable letting the skill read filenames and, by default, supported file contents inside the directory you provide. Use --name-only for lower exposure, keep scans narrowly scoped, review sensitive classifications manually, and treat CSV reports from untrusted directories carefully in spreadsheet applications.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan_files.py:338
Finding: CSV Formula Injection Through Attacker-Controlled File Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan_files.py:24
Finding: Incomplete Runtime Keyword Rules Can Misclassify Sensitive Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to scan directories, read file contents, and optionally export results, which implies file read and file write capabilities, but it does not declare any explicit tool scope or permission boundaries. This can lead to over-broad access at runtime, making it easier for the skill to read unintended files or write reports to unsafe locations if invoked with attacker-controlled paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list contains broad phrases such as 文件扫描, 合规检查, and 隐私评估, which can overlap with ordinary user requests and cause the skill to activate unexpectedly. In this skill's context, accidental activation is more concerning because activation leads to directory scanning and possible file-content inspection, increasing the chance of unnecessary access to sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file is written entirely in Chinese and defines the skill’s operational classification vocabulary in that language, which can function as a language-specific policy constraint. Under the policy, forcing a specific language without user opt-in or an explicit justification can be a violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code extracts text from matched files for keyword scanning, and the surrounding workflow recursively scans directories and processes file contents by default. Although the tool's purpose is classification, there is no explicit warning, confirmation, or prominent disclosure in code comments/help text that file contents may contain personal data and will be read and analyzed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring, help text, warnings, and output strings are written only in Chinese, with no option to select another language or locale. This creates a language constraint in the skill's natural-language interface without documented user choice or locale-specific justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.