Security audit

AI朝廷三省六部

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese-language workflow/template helper that writes local planning records and does not show hidden execution, network access, credential use, or destructive behavior.

Install this if you want a Chinese-language structured planning/review workflow. Be aware that the quick-start command creates local markdown records, so do not include secrets, credentials, regulated data, or confidential plans in those records unless local retention is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents this as an operational multi-agent collaboration system with role-based checks and balances across drafting, review, and execution. However, the supplied code only creates three markdown files containing boilerplate templates for those stages. There is no agent orchestration, no task routing, no review or veto mechanism, no execution engine, and no coordination logic beyond static text placeholders. Local filesystem writes are consistent with a document generator, but that is a materially narrower and different primary purpose than the declared multi-agent system. Therefore the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The listed trigger scenarios include very general conditions such as '用户要求多Agent协作完成任务', '复杂任务需要分解与协调', and the keyword '协作', which overlap with common task descriptions rather than uniquely identifying this skill. The file does not provide clear exclusion conditions or negative examples to bound when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs creation and archival of workflow records under predictable paths without warning about persistence, retention, or possible inclusion of sensitive task content. If users process confidential prompts, credentials, business plans, or regulated data, those details may be written to disk and retained longer than intended, increasing exposure through local compromise, backups, or accidental sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's natural-language strings and generated document templates are entirely Chinese and present the skill as producing Chinese-language workflow documents by default. There is no indication of user opt-in, configurable locale, or justification that this skill is region-specific, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file contains all headings, examples, commands, and templates in Chinese, which effectively forces a single language for use of the skill content. Under the policy, language-specific behavior should either offer user opt-in/choice or clearly justify the locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest uses Chinese-only natural-language metadata for the skill name and description, with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking context. Under the language/locale policy check, this can be interpreted as a locale-specific presentation constraint without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill reference is written in Chinese and presents all section headings, examples, and output formats exclusively in Chinese, with no indication that users may choose another language. This can conflict with language/locale policy requirements when a skill implicitly constrains interaction language without opt-in or documented regional scope.
Content: No source excerpt is available for this finding.