China Cost Estimation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed China construction-cost estimation helper that reads bundled reference data and does not show hidden access, persistence, network use, or destructive behavior.

Before installing, treat this as a regional construction-cost reference tool: verify current standards and local rates before relying on estimates for real projects. From a security perspective, the package appears limited to bundled data and local calculation behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read local reference files such as `references/cost-composition-rules.json`, but it does not declare any explicit tool scope or permissions. This mismatch can cause the runtime to grant broader-than-expected file access or leave file access policy undefined, which is a least-privilege violation and can expose unintended local data if the agent follows similar file-read patterns elsewhere.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest’s natural-language description and trigger phrases are entirely in Chinese, and there is no indication that users may interact in another language or that Chinese-only use is an explicit opt-in. Under the language/locale policy rule, this is a potential policy violation unless the locale restriction is clearly documented and justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file’s natural-language content is entirely in Chinese and references China- and Jiangsu-specific standards and rates, but it does not explicitly state that the dataset is region-specific or offer any language/locale choice. Under the policy rule, forcing a specific language or locale without opt-in or clear documented justification is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This file hard-codes Chinese-language descriptions, prompts, and output, which effectively forces a specific language/locale on users. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; this file does not provide a user opt-in or explicit justification in the code.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The metadata description and scope are written entirely in Chinese and state the data is '全国通用', which implies a China-specific locale. For SQP-3, locale-specific content should either offer user language/locale choice or clearly document why the locale restriction is justified; this JSON does not provide that justification in-policy-facing language.

Static analysis

No suspicious patterns detected.