Security audit

图书智能解读系统

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese-language book analysis template that creates local Markdown and HTML reports, with no executable code or hidden high-impact behavior found.

Install this if you want Chinese-language book reports generated as local Markdown and HTML files. Review generated reports before sharing because they may contain excerpts or notes you provided, and avoid enabling the optional mermaid CDN rendering unless you are comfortable with the resulting HTML loading a third-party script when opened.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: All user-facing instructions, trigger phrases, and examples are in Chinese, and the README does not indicate that the language is configurable or limited to a Chinese-only audience by design. This can amount to a language policy issue because the skill appears to force a specific language without explicit user opt-in.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The documented trigger phrases are very broad and overlap with ordinary user requests such as asking what a book is about or requesting analysis of a book. In agent environments with automatic skill routing, this can cause unintended activation, unexpected file creation, and processing of user-provided content when the user may not have intended to invoke this skill specifically.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The skill is written to operate in Chinese and does not state whether output language should follow the user's preference. While not directly enabling code execution or data exfiltration, fixed-language behavior can degrade user comprehension, obscure important caveats, and cause the agent to respond in an unexpected locale, which is a reliability and safety concern.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description advertises broad uses such as analyzing, summarizing, and mind-map style整理 of books without clear exclusion criteria or activation boundaries. In an agent environment, this can cause the skill to trigger on loosely related user requests and override more appropriate behaviors, increasing the chance of unintended file handling or report generation from sensitive user-provided material.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation scenarios are illustrative but do not impose hard boundaries, so the skill could activate for adjacent tasks like general document summarization or recommendations not tied to a book-analysis workflow. This ambiguity can broaden the agent's scope unexpectedly and increase misuse or accidental processing of content outside the intended domain.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: Line L185 explicitly requires HTML output to use `lang="zh-CN"`, which enforces a specific language/locale. The file does not offer user opt-in or explain that this skill is region-specific, so it conflicts with the language/locale policy criteria.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The README states that the skill outputs Markdown and HTML files but does not clearly warn users up front that it will write files into the workspace. In an agent context, silent file generation can surprise users, clutter repositories, overwrite expected outputs, or expose sensitive book notes and excerpts in saved artifacts.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: Manifest 将该技能描述为对用户提供的图书内容进行解读并产出 Markdown + HTML 双格式报告，属于内容分析与本地交付范畴。L193 却额外允许在 HTML 中嵌入来自 cdn.jsdelivr.net 的 mermaid.js，这引入了外部网络依赖，和同文件中“无需联网”“self-contained”的交付定位存在语义偏离。

Static analysis

No suspicious patterns detected.