Security audit

automotive-testcase-generator

Security checks for vulnerabilities and agentic risk

Overview

This is a content-only automotive test-case generation skill whose file reading and Excel output are disclosed and aligned with its purpose.

Before installing, confirm you want a Chinese automotive-domain test-case generator that may process provided engineering requirements and create local Excel outputs using Python/openpyxl. Avoid giving it unrelated private documents unless you intend them to be analyzed for test-case generation.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill advertises activation on a very broad set of automotive-testing keywords, including generic terms such as automotive software testing, OTA, diagnostics, and ECU-related topics. Over-broad routing can cause the skill to trigger on requests outside its real safe operating scope, leading to irrelevant file ingestion, incorrect test-case generation, or unintended processing of sensitive engineering documents.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The description is written entirely in Chinese and implies a Chinese-first interaction model without stating that output language should follow user preference. In multilingual deployments this can mis-handle user intent, reduce operator visibility into generated content, and increase the chance that reviewers miss unsafe or incorrect outputs because they cannot easily inspect the language used.

Static analysis

No suspicious patterns detected.