Security audit

中国历史年份查询

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese history lookup skill with broad triggers and imperfect coverage, but it does not show hidden persistence, credential access, local data harvesting, or destructive behavior.

Before installing, expect a Chinese-focused history assistant that may perform web lookups for supplemental facts. Verify important historical dates independently because the local converter and reference data are incomplete, and be aware that broad trigger terms may activate it on some general history questions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a multi-function Chinese history knowledge skill with three major capabilities: year conversion plus important China/world events, emperor information lookup, and historical event lookup. The supplied code only implements a narrow subset of the first capability: conversion among numeric AD years, a limited set of era names with Arabic numerals, and sexagenary year names, plus a rough dynasty label. There is no historical database, no emperor name handling, no event-name handling, and no achievement summaries. Additionally, even within year conversion, the implementation is incomplete relative to the description, because it parses only digits in era years and therefore misses common inputs like '绍定六年' or '康熙元年' despite listing them as examples. Therefore the description materially overstates and misrepresents the actual behavior.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger list is overly broad, including common words like '哪一年', '皇帝', '在位', and '历史事件', which can cause the skill to activate on unrelated user requests. In an agent environment, overbroad activation can hijack routing, produce irrelevant responses, and divert prompts away from more appropriate or safer skills.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Placeholder-style examples like '某年发生了什么' and '某事件发生在哪年' are ambiguous and do not clearly define invocation boundaries. This increases the chance of accidental triggering or misclassification of user intent, which can degrade agent reliability and cause the skill to intercept unrelated historical or date-related questions.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description and examples are entirely framed around Chinese-language inputs such as “用户发送中国古代皇帝名字” and fixed Chinese trigger phrases, with no indication that users may choose another language. This creates a locale/language constraint that is not presented as optional or justified as a region-specific policy.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The manifest describes three capabilities: year conversion, emperor queries, and historical event lookup. This file implements only conversion among Gregorian, sexagenary, and some era-year formats, with no logic or data for emperor-name queries, reign summaries, or historical-event lookup/output.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code file contains natural-language descriptions and CLI messages that assume Chinese-only usage. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This markdown file is entirely written in Chinese and presents its reference material only in that language. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This markdown file presents all instructional/content text exclusively in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This markdown file presents its content exclusively in Chinese beginning with the title, and there is no accompanying note that the language is optional, selectable, or limited to a China-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The docstring claims support for mutual conversion among 公元纪年、朝代年号纪年、干支纪年, but the implementation is incomplete for common stated inputs such as '绍定六年' and '康熙元年' because the parser only accepts Arabic numerals and not Chinese numerals or '元年'. This creates a direct mismatch between the file's stated intent and its actual accepted input behavior.

Static analysis

No suspicious patterns detected.