敏感内容扫描器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:57 AM UTC
• Version: 3.2.0

Overview

This local scanner mostly matches its stated purpose, but it can create reports with under-disclosed sensitive data and undisclosed promotional contact content.

Install only if you are comfortable with a local tool reading the files you explicitly scan and creating report files that may themselves need protection. Avoid JSON output for sensitive documents unless the raw PII behavior is fixed, review reports before sharing because they include vendor contact content, and use a specific invocation rather than a generic "scan" request.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: scripts/scan_sensitive.py:746

Finding

Undisclosed Promotional Content Injected into Generated Reports

Content

View full analysis

') h(f'

💰 Get More Accurate Content Recognition Rule Libraries

') h(f'

') h(f' For more comprehensive industry dictionaries and customized recognition rules, contact:
') h(f' 📧 [e-mail]') h(f'

') h(f'') ``` The original source uses equivalent Chinese-language text in the heading and paragraph. ### Technical Analysis The report generators append a fixed commercial solicitation and third-party email link to normal security-scan output. This behavior applies to every HTML report and every non-empty Markdown report. It is not presented as an optional feature, and the user-facing Skill documentation does not disclose that generated reports will contain promotional material. The injected block is unrelated to the requested se ...[truncated 1918 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan_sensitive.py:567

Finding

JSON Reports Persist Original Unredacted PII

Content

View full analysis

str: """Generate a report.""" if output_format == 'json': return json.dumps(results, ensure_ascii=False, indent=2) elif output_format == 'markdown': return self._generate_markdown_report(results) elif output_format == 'html': return self._generate_html_report(results) else: raise ValueError(f"Unsupported output format: {output_format}") ``` The generated report is then written directly to the selected output path: ```python # Generate report report = scanner.generate_report(results, output_format=args.format) # Write report output_path = Path(args.output) with open(output_path, 'w', encoding='utf-8') as f: f.write(report) ``` The original source contains equivalent Chinese-language docstrings, comments, and error text. ### Technical Analysis The scanner creates a masked `value` for several PII types but simultaneously stores the complete source match in the `original` field. HTML and Markdown rendering use the masked value, but JSON rendering directly serializes the underlying result structure. Consequently, every `original` field is written to the JSON report without redaction. Potentially exposed values include: - Chinese resident identity-card numbers. - Telephone numbers. - Bank-card numbers. - Email addresses. - Passport numbers. - IP addresses. - Chinese names when na ...[truncated 1993 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/custom_words_example.txt (reported line 25)May include surrounding context.

text

# 技术敏感信息
API密钥
access token
secret key
private key

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description instructs users to simply say "scan," which is too broad for a skill-selection trigger. In an agent environment, such generic wording can cause ambiguous routing or accidental execution against documents the user did not intend to analyze with this tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase “扫描” is extremely generic and can match many ordinary user requests unrelated to this specific skill. That increases the chance of unintended activation on arbitrary attached documents, which is risky because this skill processes potentially sensitive files and generates reports containing findings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that results are saved as report.html but does not clearly warn that the report may itself contain extracted sensitive strings, matches, or contextual snippets. This can create a secondary data-exposure risk if the report is stored insecurely, shared, synced, or left on disk after scanning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing natural-language instructions and examples only in Chinese, which can amount to a language policy violation when no opt-in or locale justification is provided. The content does not state that the skill is China-specific or otherwise limited to Chinese-speaking users, so it appears to force a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The scanner writes a report file that can contain matched sensitive keywords and masked-but-still-sensitive PII findings to a user-specified output path without any warning, secure file permissions, redaction control, or confirmation. In the context of a sensitive-content scanner, this increases the chance of creating a new sensitive artifact that may be stored in an insecure location, committed to source control, or accessed by unintended users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file name, headings, instructions, examples, and operational guidance are all in Chinese, and the skill does not state that it is China-specific or otherwise limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The comment states "支持中英文" (supports Chinese and English), which constrains the allowed languages for custom words to Chinese and English only. This is a natural-language locale restriction with no indication that users can opt into or override the limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language comments and labels in this file are entirely in Chinese, with no indication that users may choose another language or that the file is intended only for a Chinese-language or region-specific context. Under the stated policy, fixed language usage without opt-in or documented justification can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's docstrings, CLI descriptions, and generated reports are written exclusively in Chinese, and the HTML output explicitly sets lang="zh-CN". There is no indication that the tool is region-specific or that users can choose another language, which can violate a language/locale policy requiring opt-in or choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The HTML report footer states "本地运行，数据未上传" at L1000, which communicates a stronger no-external-interaction assurance. However, the same generated report includes commercial contact content and a mailto link at L1003-L1008, which introduces an external interaction path inconsistent with that assurance. This is documentation/UX intent divergence rather than direct exfiltration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.