保险条款分析

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:47 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Chinese-language helper for extracting structured fields from user-provided medical insurance documents, with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable processing insurance documents with a Chinese-language skill. Use it on files you intentionally provide, review the generated JSON carefully, and do not treat the extracted fields as authoritative without checking the original policy text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims to perform structured extraction of 32 insurance-specific fields and output standard JSON, but the detected behavior only supports generic document text extraction. This mismatch is security-relevant because users or other agents may rely on the claimed structured output for automated processing, causing unsafe trust decisions, silent data quality failures, or downstream workflow misuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs the agent to read user-supplied local files via `scripts/parse_document.py <file_path>` but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This creates an authorization ambiguity where the agent may access broader filesystem content than intended, especially if a user or downstream prompt influences the file path.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The manifest description and the operational instructions are all presented only in Chinese, which can impose a specific language on users without opt-in. The policy allows fixed language only when choice is offered or the locale constraint is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains user-facing instructions and format requirements solely in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when users are given a choice or the restriction is explicitly justified as region-specific, neither of which is stated here.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill description says it parses medical insurance policy documents and extracts 32 structured fields, including core and enhanced fields, with standard JSON output. In this file, the implemented behavior is limited to selecting a parser by extension, reading document text, and printing the raw extracted text without any field extraction or JSON serialization.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The docstring states the script supports PDF/DOCX/TXT parsing and extracts plain text, and the main docstring says it outputs text content. This contradicts the broader claimed intent of producing structured insurance-field JSON, because the documented purpose here is only plaintext extraction rather than the advertised structured parsing outcome.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This code file contains natural-language descriptions, usage text, and error messages exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy allows locale constraints only when explicitly documented and justified or when users are offered a choice, neither of which appears here.

Static analysis

No suspicious patterns detected.