Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
subagent-first
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed workflow guide for delegating long agent tasks to subagents, with clear cautions about verification, user decisions, side effects, cost, and persistence.
Install this if you want a Chinese-language delegation workflow and are comfortable letting your agent use subagents for larger tasks. Keep user decisions, irreversible changes, public posting, payments, deletes, and long-lived background jobs under explicit main-agent/user approval, and verify subagent outputs before trusting them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger list includes broad natural-language phrases such as '批量处理', '长研究', '并行执行', '等太久', and 'AI不回话', which can match many ordinary conversations unrelated to this specific skill. That can cause unintended invocation of the skill's behavioral instructions, unexpectedly altering agent control flow and tool-usage patterns in contexts where the user did not ask for delegation orchestration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill’s natural-language instructions and user-facing content are entirely in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a language/locale policy violation unless the constraint is documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file is entirely written as normative guidance in Chinese and presents itself as a reusable skill reference library, but it does not indicate that language is optional or limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s natural-language instructions, usage documentation, and all user-facing output are written as Chinese-only guidance, and the script description states its purpose entirely in Chinese. Because there is no opt-in, locale selection, or documented region-specific justification, this appears to impose a fixed language on users in a way that violates the language/locale policy criteria.
- Content
Static analysis
No suspicious patterns detected.