Security audit
Security checks for vulnerabilities and agentic risk
This paid quality-check skill is not clearly malicious, but it deserves review because it can send user documents or directories to a third-party paid gateway under broad trigger phrases.
Before installing, decide whether you are comfortable sending inspected content, including possible client documents, code, PDFs, or directories, to the publisher’s paid gateway. Use it only with explicit user intent, avoid broad directory scans, and require confirmation before any external upload, payment, or follow-on edit.
The English description presents a comprehensive multi-format quality inspector, yet the skill content primarily defines process rules and monetized access to an external endpoint rather than trustworthy in-file enforcement of those checks. This mismatch is risky because downstream agents or users may treat the skill as an authoritative compliance gate when it is effectively opaque and externally delegated.
The English description presents a comprehensive multi-format quality inspector, yet the skill content primarily defines process rules and monetized access to an external endpoint rather than trustworthy in-file enforcement of those checks. This mismatch is risky because downstream agents or users may treat the skill as an authoritative compliance gate when it is effectively opaque and externally delegated.
The English description presents a comprehensive multi-format quality inspector, yet the skill content primarily defines process rules and monetized access to an external endpoint rather than trustworthy in-file enforcement of those checks. This mismatch is risky because downstream agents or users may treat the skill as an authoritative compliance gate when it is effectively opaque and externally delegated.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
**Three hard prohibitions**:
- ❌ **No rewriting** — the report stage never touches the original; edits require user confirmation
- ❌ **No author attribution** — never judge "was this written by AI"; only judge "can this be delivered"
- ❌ **No fabrication** — no adding numbers, quotes, or cases
---
Line L018 states that the main SKILL.md body was fully converted from English to Chinese to fix display issues. This describes a language choice being imposed rather than offering a user-selectable locale, which conflicts with the policy against forcing a specific language without opt-in.
This markdown file contains natural-language terms that effectively force a specific language/locale context: the license is presented in Chinese and explicitly states it is governed by the laws of the People's Republic of China. Under the policy, locale or language constraints should either offer user choice or be clearly justified as region-specific; this document does not provide such opt-in or justification within the file.
The core design explicitly says "Report only, never edit," establishing a no-edit intent. Later, the comparison table says "Report only; edits require confirmation," which contradicts the earlier absolute claim by implying the skill may support editing in some cases.
The trigger phrases are broad natural-language requests like 'check this for problems' and 'can I deliver this,' which can cause unintended skill activation during ordinary conversation. In an agentic environment, overly generic triggers can route sensitive or unrelated user content into the skill without clear user intent, increasing the chance of surprise processing, privacy exposure, or workflow interference.
The trigger phrases are very broad and overlap with common conversational requests such as '帮我看看有没有问题' and '检查一下这个'. In an agent skill context, this can cause accidental activation on unrelated user messages, leading the skill to inspect or process content when the user did not explicitly intend to invoke this commercial QC workflow.
The trigger phrases include broad everyday language such as '质检', '交付前检查', and 'can I ship this', which increases the chance of accidental invocation. In this skill, accidental invocation is more concerning because it can steer users into an external paid workflow and transmit content to a remote service unexpectedly.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
description: >-
交付前的最后一道关口！让每一份 AI 交付都经得起质检——ontoAI质检官 Plus。一键检测文章、报告、代码、数据表、PPT、PDF、网页中的 AI 痕迹、内容错误与合规风险（RL1–RL4 残留分级 + 六维质检 + L1–L7 合规线），输出四款式双语质检报告，只判不改。按调用量计费 ¥1.9/次；规则库月度更新、最新质检方案检索、区块链存证背书（CZ20260215641694）、优先支持。触发词：质检、交付前检查、能不能发、ontoAI质检官。
description_en: >-
The last gate before delivery! Every AI deliverable passes QC here — ontoAI Quality Inspector Plus. One-pass detection of AI residue, content errors and compliance risks (RL1–RL4 residue tiers, six QC dimensions, L1–L7 compliance lines incl. China Advertising Law and FTC truth-in-advertising) across articles, reports, code, data tables, slides, PDFs, web pages, audio/video and combined artifacts. Outputs bilingual four-style QC reports (HTML/PDF) with a four-tier verdict: Must Fix / Should Fix / Unverified / Passed. Report-only by default; never edits without confirmation; never fabricates. Plus edition: per-call billing CNY 1.9; monthly rule-pack updates, blockchain-notarized rule base (cert CZ20260215641694), priority support. Triggers: QC this, quality check, pre-delivery check, can I ship this, ontoAI QC.
allowed-tools:
- Read
- Write
The metadata states “中文为默认报告语言”, and the workflow later reiterates “默认中文”, which imposes a language default rather than offering a neutral user choice. Under the policy, language constraints should be opt-in or clearly justified as region-specific; here the skill also advertises bilingual output, making the forced default more notable.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
The file header, usage instructions, and runtime messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly calls out language or locale constraints as violations when the skill does not offer a choice or justify the restriction.
The document root sets lang="zh-CN", indicating a fixed locale by default. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless the constraint is explicitly justified or optional.
DATA.lang is set to "zh", which makes the generated report content default to Chinese-language labels and messaging. Although English localization exists, the file does not present this as an explicit user opt-in at the content level, so the locale is effectively preselected.
The trigger list includes very broad everyday phrases such as '帮我看看有没有问题' and '检查一下这个', which can match many unrelated user requests and cause the skill to activate unintentionally. In a skill with web access and file read/write capabilities, accidental invocation increases the chance of unnecessary data exposure, unwanted external fetches, or the skill taking over conversations where the user did not intend a formal QC workflow.
The template explicitly asks whether the skill should 'execute' the must-fix edits, which conflicts with the documented '只判不改' boundary. In an agent setting, this can cause downstream implementations to mutate user content without an explicit, separately authorized editing step, creating scope creep and unsafe automation.
The full example repeats that the skill may perform the required edits itself, reinforcing behavior beyond quality inspection. Because examples often drive implementation more strongly than policy text, this increases the risk that operators or wrappers will treat modification as in-scope and alter documents under the guise of QC.
The DATA schema includes a 'next' field suggesting the system can carry out edits, which documents an operational contract for modification rather than inspection only. If integrators render or act on this field automatically, users may be nudged into unintended editing flows and the skill's least-privilege boundary is weakened.
The entire skill file is written in Chinese and does not offer any language or locale choice, nor does it document that the skill is intentionally region- or language-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The report explicitly promises not to alter source text, yet the English localization function performs global string replacements on the fully rendered HTML, including quoted evidence fields. This can silently modify verbatim excerpts in the final report, undermining integrity of audit evidence and potentially causing users to rely on falsified or inaccurate quotations.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal