数字大脑工厂

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 1.2.0

Overview

The skill is a disclosed paid remote analysis/governance service, but users should treat submitted research or system details as data sent to an external service.

Install only if you are comfortable sending the selected research text, system descriptions, audit context, and callback URLs to the provider's service. Do not submit confidential IP, secrets, production architecture details, or sensitive logs unless you have separately verified the provider's privacy, retention, authentication, and payment handling practices.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/api_handler.py:6

Finding

Payment Verification Can Be Bypassed or Forged

Content

View full analysis

0.001: return {"status": "error", "message": "支付金额不匹配"} return {"status": "verified", "price": price, "transaction_id": payment_credential.get('transactionId', '')} ``` ### Technical Analysis The manifest declares `requires_wallet: true`, but `handle_request()` only performs payment verification when `payment_credential` is truthy. An omitted or empty credential therefore skips the payment check and proceeds to the success response. When a credential is supplied, `verify_payment()` trusts caller-controlled fields such as `payStatus`, `paidAmount`, and `transactionId`. It does not verify a cryptographic signature, consult an authoritative payment provider, validate the payment recipient or currency, bind the transaction to the requested task, or prevent transaction replay. Consequently, both of the following requests can pass the payment gate: 1. A request with no payment credential. 2. A reques ...[truncated 1715 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A second description-behavior mismatch indicates the skill may validate payment proofs and handle billing despite being presented as a cognition/research service. Undisclosed financial-processing behavior expands the attack surface and can lead to misuse of credentials, surprise charges, or improper handling of transaction-related data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second description-behavior mismatch indicates the skill may validate payment proofs and handle billing despite being presented as a cognition/research service. Undisclosed financial-processing behavior expands the attack surface and can lead to misuse of credentials, surprise charges, or improper handling of transaction-related data.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · governance_protocol.md (reported line 18)May include surrounding context.

1. 验证协议可用性

bash

curl -s http://127.0.0.1:8700/governance/health | python3 -m json.tool

期望返回：{"status":"ok","protocol":"v19-governance-protocol","version":"1.0.0"}

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · governance_protocol.md (reported line 24)May include surrounding context.

2. 执行一次对偶审计

bash

curl -X POST http://127.0.0.1:8700/governance/audit -H "Content-Type: application/json" -d "{\"decision_id\":\"test_001\",\"context\":\"测试接入\",\"chosen_action\":\"验证连通性\",\"evidence\":\"health检查成功\"}"

3. 执行一次因果归因

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

整份技能说明和示例均以中文固定呈现，未说明是否支持其他语言，也未向用户提供语言/locale 选择。若该技能面向通用用户或代理生态，这种默认强制单一语言的自然语言策略可能构成语言/locale 政策不合规。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples instruct users to send content to a remote analysis API and optionally specify a callback URL, but the documentation does not clearly warn that user-provided research text or system-audit material leaves the local environment. In a skill centered on paper review and system audit, this omission is especially risky because the inputs are likely to contain confidential intellectual property, architecture details, or security-sensitive data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This finding duplicates the external transmission already evidenced at line 33: the skill directs data to a third-party API endpoint. Because the service domain differs from the declared gateway and processes substantive user content, the transmission risk is real and contextually significant for research and audit workflows.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

示例1：论文评判

bash

curl -X POST https://api.v19-cognition.com/analyze -H "Content-Type: application/json" -d "{\"task_type\":\"paper_review\",\"content\":\"机器学习在NLP中的应用研究\",\"depth\":4}"

示例2：系统审计

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This finding duplicates the external transmission already evidenced at line 33: the skill directs data to a third-party API endpoint. Because the service domain differs from the declared gateway and processes substantive user content, the transmission risk is real and contextually significant for research and audit workflows.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

示例1：论文评判

bash

curl -X POST https://api.v19-cognition.com/analyze -H "Content-Type: application/json" -d "{\"task_type\":\"paper_review\",\"content\":\"机器学习在NLP中的应用研究\",\"depth\":4}"

示例2：系统审计

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The system-audit example transmits a description of an AI system and a callback URL to an external API. This is particularly dangerous because system-audit inputs often contain security architecture details, and the callback mechanism can introduce additional privacy, SSRF-style, or data-leakage concerns if not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

示例2：系统审计

bash

curl -X POST https://api.v19-cognition.com/analyze -H "Content-Type: application/json" -d "{\"task_type\":\"system_audit\",\"content\":\"我的AI系统包含支付、认知、执行模块，请审计其完整性\",\"callback_url\":\"https://my-server.com/result\"}"

错误处理

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The governance protocol examples initiate HTTP requests to a localhost service. Although loopback traffic is not internet exfiltration, invoking local services from a skill can still access privileged internal components and may interact with sensitive agent-side control planes if users follow the example blindly.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

bash

# 验证协议
curl -s http://127.0.0.1:8700/governance/health
# 对偶审计
curl -X POST http://127.0.0.1:8700/governance/audit -H "Content-Type: application/json" -d '{"decision_id":"d001","context":"测试","chosen_action":"验证","evidence":"ok"}'
# 因果归因

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are broad and loosely bounded, covering general requests to review papers, analyze research, audit systems, diagnose cognition, or integrate governance. Overbroad activation can cause unintentional invocation on sensitive content and unexpected transmission of user data to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document instructs users to send data to governance endpoints and to obtain an API key, but it provides no warning about what data may be transmitted, how credentials should be stored, or whether sensitive decision context may leave the local trust boundary. In an agent-skill context, this omission can lead operators to forward internal state, error logs, or decision evidence without informed consent or proper secret handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The example performs a POST request carrying decision context and evidence to a service endpoint, which is an external transmission from the perspective of the skill/operator boundary even if the host is localhost. In this skill's governance/audit context, the payload may contain sensitive operational metadata, and normalizing such transmission without caution can encourage leakage of internal reasoning, logs, or identifiers to auxiliary services.

Content

Scanner excerpt · governance_protocol.md (reported line 24)May include surrounding context.

2. 执行一次对偶审计

bash

curl -X POST http://127.0.0.1:8700/governance/audit -H "Content-Type: application/json" -d "{\"decision_id\":\"test_001\",\"context\":\"测试接入\",\"chosen_action\":\"验证连通性\",\"evidence\":\"health检查成功\"}"

3. 执行一次因果归因

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes core services such as paper evaluation, research analysis, system audit, and cognitive diagnosis, but this handler does not perform or invoke any visible analysis on the submitted content. Instead, it verifies payment, looks up pricing, and returns a generic message saying the task was queued, which is a semantic mismatch with an API that appears to handle the requested service directly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring, error message, and success result text are presented only in Chinese, which imposes a specific language on users without opt-in. The file does not indicate that this is a justified region-specific skill or provide any mechanism for language selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code accepts a payment credential and sends it to verify_payment, which is a safety-relevant credential-handling operation. The file includes no confirmation prompt, logging/print statement, or explanatory warning to the user about credential use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment at L18 states '返回分析结果' ('return analysis result'), but the returned object contains no analysis output and instead reports success, price, depth, and a message that the request was placed into a processing queue. This is an active contradiction between the documentation comment and the implemented behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill focused on paper evaluation, research analysis, system auditing, cognitive diagnosis, and governance protocols. This file implements pricing lookup and payment verification logic, which is a business/commerce capability rather than an obvious requirement of those cognition-governance services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code contains natural-language strings only in Chinese, including the function docstring and all returned error messages. The file provides no user language choice or justification that the skill is region-specific, which conflicts with the policy against forcing a specific language or locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

All user-facing instructions in this file are presented exclusively in Chinese, and there is no indication that the skill supports multiple languages or that Chinese-only usage is an intentional, documented constraint. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.