Security audit

Qa Testcase Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a normal QA helper that reads requirement documents and writes test-case reports, with no evidence of hidden network access or destructive behavior.

Use this skill when you want an agent to process requirement documents and create JSON/Excel test-case files. Keep sensitive requirement documents in a trusted workspace, choose output paths deliberately to avoid overwrites, and treat bundled credentials and product-specific examples as sample data rather than reusable real values.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill appears to use file read/write capabilities without explicitly declaring them, which weakens permission transparency and can cause the skill to access or persist user data in ways reviewers and users did not expect. In a document-processing skill that handles requirement files and generates outputs, undeclared filesystem access increases the chance of over-broad data exposure or unauthorized file modification if the implementation is abused or misconfigured.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill's declared purpose does not match its broader behavior, including undisclosed pairwise suite generation, audit/comparison reporting, and unrelated JSON utilities, while also overstating image-flowchart parsing capabilities. This mismatch is dangerous because reviewers and users may authorize a narrow test-case generator while the skill performs additional processing paths and file operations outside the expected trust boundary.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file is a large prebuilt corpus of end-to-end product test cases spanning many domains, which goes far beyond the skill’s stated purpose of generating test cases from user-supplied requirement documents. That creates a scope-confusion risk: the skill can inject unrelated, highly specific internal workflows, endpoints, roles, and operational assumptions into outputs, causing data leakage, unsafe overreach, and misleading automation behavior.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The embedded test data includes realistic-looking usernames, passwords, and similar operational secrets patterns that are unnecessary to a generic testcase-generation skill. Even if intended as examples, hardcoded credentials normalize secret exposure, may be copied into real environments, and can reveal internal conventions useful for attackers.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document gives mutually contradictory rules about whether full-reduction promotions can stack with flash-sale discounts, including multiple claims of which rule is final. In a test-case generation skill, this is dangerous because the agent may generate inconsistent or incorrect test cases, leading teams to validate and implement the wrong business logic for pricing and promotions.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match common QA requests such as '生成测试用例' or '测试计划', which can cause the skill to auto-activate in conversations that only mention testing at a high level. In an agent platform, overbroad activation expands the skill's execution surface, increasing the chance of unintended file processing, surprise behavior, or prompt-context hijacking through normal discussion rather than explicit user intent.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Broad trigger phrases such as generic requests to generate tests or coverage can cause the skill to activate in contexts the user did not intend, leading to accidental ingestion of documents and creation of output files. For a skill with document-reading and file-writing behavior, unintended activation expands the attack surface and may expose sensitive project content to the wrong workflow.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to write analysis output into a workspace file, which causes a local file modification side effect. While this appears operational rather than malicious, it can still overwrite existing artifacts or create files without an explicit user-facing warning or confirmation, especially if the workspace path is broader than expected.

Static analysis

No suspicious patterns detected.