Security audit

AI 文旅目的地架构师

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language tourism strategy skill with optional local validation scripts, and I found no hidden data access, network use, or automatic persistence.

Use this skill if you want a Chinese-language framework for tourism destination investment and planning. Before enabling the optional hook, confirm you are comfortable with it checking a prediction ledger and potentially blocking edits when the sealed prediction section changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is strategic tourism analysis, but the skill also describes operational behavior that reads files, writes .sha256 artifacts, validates content integrity, and enforces workflow outcomes via hooks and exit codes. This mismatch is dangerous because users and reviewers may trust the skill as a harmless advisory assistant while it actually performs repository-governing actions with persistence and process-control effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and core description are written in Chinese and the document provides no indication that users may interact in other languages or choose their preferred locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy issue unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill references enforcement scripts and hook-based guard behavior that imply file-write capability, but it does not declare any explicit tool scope or permissions boundary. Undeclared write access increases the risk of unexpected side effects, makes review harder, and can let a seemingly advisory skill modify repository state when integrated into an agent runtime.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and title are written as a Chinese-first skill persona ('AI 文旅目的地架构师') and the document provides all operating instructions in Chinese without indicating that users may choose another language. This creates a language/locale policy concern because the skill appears to impose a specific language by default rather than offering opt-in or a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The entire skill is written as a mandatory Chinese-language interaction contract, including output templates and labels, but nowhere offers the user a language/locale choice or states that the skill is intended only for a Chinese-language or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file presents all instructions and output contracts only in Chinese, which can amount to a language policy constraint if users are not given any option to select another language. The policy explicitly calls for flagging language or locale restrictions unless the skill offers user choice or clearly documents a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. That can violate language/locale policy expectations when a skill is intended for broader organizational use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill is written as mandatory Chinese-language guidance and does not indicate that users may choose another language or locale. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill specification is written as a prescriptive Chinese-only module, including required output sections and phrasing, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, usage instructions, and later user-facing status messages are written entirely in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when user choice is offered or the constraint is clearly documented and justified; neither appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The title and the entire template are written in Chinese, and the instructions present this as a mandatory format rather than an optional locale. This can violate language/locale policy because it forces a specific language without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown template presents all instructions, labels, and guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown template forces a specific language/locale for all users through its headings, instructions, and checklist content. The file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific purpose, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file title and instructions are entirely in Chinese, and line L003 imposes strict wording rules in that language. This effectively forces a specific language/locale style without any user opt-in or explanation that the template is intended only for a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON schema contains multiple natural-language descriptions and enumerated values that are exclusively in Chinese, including user-facing semantic fields such as confidence and verdict. Under the policy, forcing a specific language without opt-in or a documented region-specific justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire workflow is written in Chinese and includes prescriptive output labels and instructions only in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-language or region-specific context. Under the language/locale policy rule, a skill that implicitly requires one language without opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The workflow explicitly directs the designer to create '传播触发'、'社交货币' and '复购钩子' without any balancing requirement for user autonomy, consent, privacy, or anti-manipulation safeguards. In a tourism-planning skill, this can normalize dark-pattern style engagement design, encourage excessive behavioral nudging, and lead downstream users to build campaigns that pressure sharing or retention without transparent notice or data-governance controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. That can conflict with organizational language/locale policies requiring user opt-in or documented justification for a forced locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all user-facing instructional content in Chinese and does not indicate that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the language/locale policy rule, forcing a single language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file is entirely written in Chinese and presents the skill guidance as mandatory instructions, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown template enforces a single language throughout the file, including headings, instructions, and checklist text. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template forces a specific language/locale for all users through its headings, instructions, and checklist items. Under the policy, language-specific content should either provide user opt-in or clearly justify the locale restriction; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, including the title, workflow steps, constraints, and output contract. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or opt-in is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.