Security audit

Product Sourcing Advisor

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only sourcing-advice skill with no executable behavior, but users should treat its English-language scoring examples as business-context dependent rather than universal.

Before using the skill for real supplier selection, adjust communication scoring to focus on responsiveness, clarity, escalation process, documentation quality, and support in the buyer's required business language, including translation or account support where appropriate.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill bakes English proficiency into supplier evaluation as a default quality signal without requiring user justification or clarifying that language capability should be tied to operational needs. This can bias recommendations against otherwise strong suppliers based on language rather than objective sourcing performance, creating discriminatory or unfair decision support outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly instructs users to score communication using English proficiency by default, operationalizing a language-based preference in core decision logic. Because this is positioned as standard methodology rather than an optional consideration, it can systematically skew supplier rankings and procurement outcomes in a discriminatory way.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example scorecard rewards a supplier for being 'English fluent,' reinforcing language ability as a built-in positive factor in ranking. Examples are normative in skills documentation, so this can propagate biased use even if the underlying intent is practical rather than malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This example again treats English fluency as a favorable default attribute, normalizing language preference across sourcing recommendations without user choice. Repetition across examples increases the chance that downstream users adopt language-based filtering as standard practice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The common-mistakes section generalizes limited English proficiency as a supplier drawback, which can encourage broad exclusion of suppliers on a protected or sensitive attribute proxy rather than on measurable business performance. In a procurement advisory skill, this creates heightened risk of biased vendor selection and unfair treatment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The communication rubric explicitly rewards 'Fluent English' and penalizes suppliers with weaker English, without tying that preference to a user-selected business language or objective operational need. In a sourcing workflow, this can systematically bias supplier selection against otherwise qualified vendors based on language ability rather than product quality, cost, or the availability of translation/intermediary processes, creating discriminatory or unfair procurement outcomes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.