Back to skill

Security audit

我的测试节能

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Chinese-English technical translation skill with no executable behavior or hidden data flow.

Install this skill if you want consistent Chinese-English technical documentation translation. It is not a general multilingual translator, and its bundled glossary/style choices may need adjustment for a specific team's terminology preferences.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description defines the skill exclusively as Chinese-English bidirectional translation, which imposes a specific language/locale scope in natural-language instructions. The file does not present this as a user-selectable preference or explicitly justify the restriction as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document prescribes fixed language-specific rules for both Chinese-to-English and English-to-Chinese translation, including mandatory use of English punctuation in one case and Chinese punctuation in the other. This is a natural-language policy concern because it forces locale-specific output conventions without indicating user choice, opt-in, or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Line L005 states that translation must strictly follow this Chinese-English glossary, which imposes a specific language/locale convention. The file does not indicate user opt-in, alternatives, or that this is a justified region-specific constraint, so it may violate language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This section explicitly instructs authors to use "you" and provides only English pronoun examples, which effectively prescribes English-centric wording in a general writing guideline. Because the document is otherwise bilingual and not clearly limited to an English-only context, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/writing-guidelines.md (reported line 251)May include surrounding context.

Example Request:

bash
curl -X GET https://api.example.com/v1/users/12345 \
  -H "Authorization: Bearer YOUR_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/writing-guidelines.md (reported line 298)May include surrounding context.

Example Request:

bash
curl -X GET https://api.example.com/v1/users/12345 \
  -H "Authorization: Bearer YOUR_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/writing-guidelines.md (reported line 305)May include surrounding context.

Example Request:

bash
curl -X GET https://api.example.com/v1/users/12345 \
  -H "Authorization: Bearer YOUR_TOKEN"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The rule '英文代码注释使用英文' requires English comments for English code, which imposes a language policy rather than offering a choice based on team or user preference. The file does not justify this as a region-specific or compliance-specific requirement, so it fits the language-policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.