Security audit

Document Compliance Audit Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent offline document-audit tool, but its HTML report generator can embed unescaped user-controlled text, so reports from untrusted documents or rule files may execute browser content when opened.

Use JSON or Markdown output, or only open HTML reports generated from documents and custom rule files you trust, until the publisher escapes all user-controlled fields in HTML. Review the custom rules directory before use because its messages and patterns affect report content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill makes strong safety claims such as reading only the input file and writing only the named report file, but the documented behavior also includes reading arbitrary files from an external rules directory and generating multiple demo outputs. This mismatch can cause operators to grant trust or permissions under false assumptions, increasing the risk of unintended file access, unsafe automation decisions, or policy bypass in restricted environments.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The clause '乙方应尽快完成交付' uses vague timing language that creates an indeterminate performance obligation. In a contract context, this ambiguity can be exploited by the stronger party to argue breach opportunistically or to impose shifting expectations, especially when paired with other one-sided terms such as unilateral adjustment and interpretation rights.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains all headings, labels, findings, and audit trail text in Chinese, but provides no notice that the skill is Chinese-only or offers any language selection. That can violate language/locale policy when users have not explicitly opted into Chinese output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains instructions, rule descriptions, and examples predominantly in Chinese, which can effectively force a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated HTML explicitly sets lang="zh", which forces a specific locale in output regardless of user preference. This is a natural-language policy concern because the file otherwise accepts generic document inputs and does not provide any user-selectable language or locale option.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.