Security audit

CMMI认证助手/CMMI-cert-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a local CMMI document assistant with disclosed automatic handling of uploaded documents, but its generated templates need review for accuracy.

Before installing, be comfortable with the skill automatically reading uploaded project documents and creating derivative compliance files. Review generated documents carefully, especially PA mappings such as EVW, MST, ESAF/ESAC, and PCM/PCMD, because some bundled templates appear inconsistent or placeholder-like.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a multi-function CMMI certification assistant centered on analyzing uploaded project documents, mapping them to practice areas, identifying evidence gaps, and converting documents into compliant outputs. The supplied code does only one subset-related function: generate a Word document from predefined JSON configuration for a selected PA. It creates formatted sections with placeholder content and saves a .docx file. There is no code for file upload handling, parsing existing project documents, semantic or rule-based PA matching, evidence completeness analysis, or document conversion from source materials. While document generation loosely overlaps with the declared 'document conversion/output compliant documents' idea, the implemented behavior is materially narrower and lacks the assistant's primary analysis capabilities, so this is a mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes uploading project documents and then automatically performing analysis and generating compliant .docx outputs, but it does not clearly warn users that their documents will be processed immediately and that new files may be created automatically. In the context of enterprise certification materials, uploaded documents may contain confidential project, process, supplier, or security information, so undisclosed automatic processing increases privacy, data handling, and user-consent risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that PA matching and document generation run automatically upon document upload, with no manual confirmation in normal cases. For a skill that processes potentially sensitive project documents and can create derivative files, broad auto-triggering increases the chance of unintended invocation, processing without sufficient user awareness, and accidental generation of misleading or sensitive compliance artifacts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs automatic reading of uploaded documents and automatic generation of derivative compliance documents without explicit consent, warning, or clear boundaries on document handling. In a certification context, uploaded materials may contain confidential project, customer, security, or regulatory information, so silent auto-processing increases the risk of unintended exposure and user surprise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The rule '记住用户是PM：用项目经理能理解的语言' is acceptable by itself, but the surrounding document is structured as bilingual and does not explicitly let the user choose output language. In this context, the skill is framed primarily in Chinese and assumes a default locale/language behavior without opt-in, which can violate language-choice policy if responses are forced to one language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction '当用户要求将自己的文档转换为CMMI合规格式时，按以下结构输出' is followed by a fully Chinese template, which implies the skill should produce output in Chinese by default. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking context, creating a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction '当用户要求将自己的文档转换为CMMI合规格式时，按以下结构输出' is presented entirely as a mandatory output template in Chinese, with no indication that another language can be used if the user prefers. This creates a natural-language locale constraint without user opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is written entirely in Chinese and instructs behavior such as document conversion and interview question usage in Chinese, but it does not state that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language instructions and descriptions that force a specific language/locale for users. The policy allows locale constraints only when users are given a choice or the limitation is clearly justified as region-specific, which is not present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest scopes this skill to CMMI V3.0 practice-area matching, gap analysis, and compliant document conversion for appraisal preparation. The EVW entry defines templates for '电动汽车保修管理' (electric vehicle warranty management), which is a domain-specific business capability unrelated to CMMI certification assistance and therefore exceeds the stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, including the title, guidance, and interview questions. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all instructions and reference material only in Chinese, and does not indicate that the user can choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file content is entirely written in Chinese, including headings, guidance, and interview questions, with no indication that users may choose another language. Under the policy rule for natural-language constraints, this is a locale/language restriction unless it is explicitly justified as region-specific or offers opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该技能文件整体以中文编写，并在标题、章节和输出模板中默认要求使用中文表述，但未说明这是面向中文用户的限定场景，也未提供其他语言选项。根据语言/区域政策，若技能默认强制特定语言而没有用户选择或明确 justification，属于自然语言层面的策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown skill reference forces a specific language/locale for all user-facing guidance and templates. Under the natural-language policy rule, a skill should not impose a language without user opt-in unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains instructional content exclusively in Chinese, including headings, guidance, and interview questions, but does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking context. Under the language/locale policy criterion, forcing a single language without user opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains all user-facing guidance in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. The stated policy flags language/locale constraints when they are imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing instructional content solely in Chinese, including headings, guidance, and interview questions. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative or opt-in is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all instructions, labels, and examples exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content is written in Chinese, including headings, instructions, templates, and interview questions, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction says that when the user asks to convert their document, the output should follow the provided structure, and the template is entirely in Chinese. This imposes a specific language/locale on generated content without any visible opt-in or alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, including headings, guidance, and interview questions, but does not indicate that the language is optional or limited to a specific region or audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all headings, instructions, and examples exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or scope justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file contains operational guidance for users entirely in Chinese, including conversion instructions and interview questions. Under the policy rule for language or locale, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative or opt-in is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.