Security audit

AutoDoc NEXT2.0

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uploads one user-selected prospectus to PAODINGAI/PDRouter for audit and downloads a verified annotated result, with no evidence of hidden persistence or unrelated behavior.

Install only from a source/version you trust, keep the PAODINGAI API key private, and run the skill only on prospectus files you are permitted to upload to the configured PDRouter service.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
- Run upload/polling and download through the separate commands in `scripts/audit_document.mjs`.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes access to environment secrets and local files but does not declare an explicit tool/permission scope. In a host that relies on manifest-declared permissions for user review or enforcement, this creates ambiguity and can lead to broader-than-expected access to sensitive data such as API keys and local documents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: Using npx skills add PaodingAI/skills without a pinned version makes installation depend on whatever package state is current at execution time. This creates a supply-chain risk where a compromised upstream package, typo-squat, or unexpected update could change the installed code without review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions require the assistant to summarize progress events in Chinese and even provide a Chinese heartbeat/update format. This imposes a specific language on user-visible output without offering the user a choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script reads the local prospectus file and submits it to a remote PDRouter service, but the CLI flow does not provide a clear, explicit warning or consent prompt that document contents leave the local machine. Because prospectuses may contain confidential or regulated information, users can unknowingly exfiltrate sensitive data to a third-party service simply by running the command.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's natural-language errors and status messages are consistently presented in Chinese, which imposes a specific language on users without any opt-in or fallback. The stated policy flags forced language or locale behavior unless a choice or justified locale constraint is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The command validation and subsequent CLI guidance use Chinese-only text, continuing the language-lock behavior for general interaction. There is no visible mechanism for users to choose another language or indication that the tool is restricted to a Chinese-speaking environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.