Security audit

Business Data Analyst

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed business-analysis and market-research helper with a small keyword router and no evidence of hidden execution, persistence, credential access, or data exfiltration.

Install this if you want a broad business-analysis assistant. Be mindful that market-research tasks may send search queries through whatever tools your host provides, and avoid pasting confidential business data unless that host environment is approved for it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents the skill as an analysis-and-diagnosis capability that can translate business questions into analysis plans, define metric logic, validate data quality, break down business changes, identify root causes, quantify impact, and produce recommendations. The supplied code does not implement those analytical behaviors. Instead, it classifies incoming messages using keyword rules and returns an intent, confidence, reason, and prompt hint for downstream use. That is a materially different primary purpose: routing/intention detection rather than analysis execution. Additionally, the code supports a 'market_research' intent and related signals, which extends beyond the described core business data analysis scope. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
- 如果宿主支持内部路由层，可使用 `src/router.js` 先判断是否属于增长、漏斗、留存、收入利润、效率、市场调研或经营诊断场景。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
md
- 若用户问题偏战略/竞争/营销/财务/市场判断，优先从 `SKILL.md` 保持主线，再按需读取 `metric-playbook.md` 或 `market-research.md` 中对应章节，不要一次把所有参考材料都塞进上下文。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The package declares a very large and diverse keyword set spanning business analysis, strategy, finance, marketing, market research, SQL, and bilingual terms, which can make the skill match far more user intents than its narrowly safe operating envelope. In an agent marketplace or auto-routing environment, overly broad activation metadata increases the chance the skill is invoked on ambiguous requests and may receive sensitive business or analytical tasks it was not explicitly scoped or governed for.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is natural-language guidance, and it presents all instructions exclusively in Chinese from the title through the final section. That can violate language/locale policy when the skill implicitly forces a specific language without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file is a markdown skill/reference document, so natural-language policy checks apply. The content consistently forces a specific language/locale for all users and does not provide opt-in, alternatives, or justification that the skill is region-specific, which fits the language/locale policy-violation criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The title and entire specification are written exclusively in Chinese, and no alternative language or user-selectable locale behavior is documented. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The router explicitly expands the skill into market research and competitive analysis scenarios even though the manifest describes a business analysis/operating diagnosis skill. This creates a scope mismatch: users or orchestrators may invoke capabilities that rely on external-domain reasoning and data collection not declared in the skill contract, increasing the chance of unintended tool use, policy bypass, or unsafe delegation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code returns natural-language reasons, labels, and prompt hints entirely in Chinese, such as the reason strings and intent labels. That enforces a specific language/locale in skill behavior without any visible opt-in or alternative, which matches the policy-violation criterion for forced language selection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt hint for market research tells the agent to use search tools to collect external information, but that capability is not described in the stated skill scope. In an agent system, hidden or undocumented encouragement to access external sources can cause unreviewed data egress, provenance issues, and behavior that bypasses user or platform expectations about what the skill is permitted to do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The test cases predominantly validate routing behavior using Chinese-language user messages, which suggests the skill behavior may be designed around a specific language/locale. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file documents the addition of Chinese-titled sections such as “市场调研”, “搜索工具使用纪律”, and other Chinese section names in SKILL.md. Because the policy forbids forcing a specific language or locale without user opt-in, these entries suggest language-specific content may be introduced without any documented choice mechanism or region-specific justification in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file presents the skill name, tagline, and core description entirely in Chinese, with no indication that other languages are supported or that Chinese is optional. Under the policy scope for natural-language violations, this can be interpreted as a language/locale constraint imposed without explicit user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 63% confidence
Finding: The smoke test example is written in Chinese, and the manifest keywords heavily emphasize Chinese and bilingual terms, which suggests the skill may default to or strongly target a specific language experience. This file does not explicitly state that users can choose their preferred language or that the locale behavior is opt-in.
Content: No source excerpt is available for this finding.