Security audit

Estimate Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a construction cost estimating skill with some reliability and scope-documentation issues, but no hidden execution, credential access, persistence, or exfiltration behavior was found.

Install only if you want help with construction cost estimates. Treat outputs as draft calculations, verify applicable standards, rates, currency, and category mappings before using them for bids, contracts, or regulatory submissions, and be deliberate about any spreadsheet export path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The natural-language description, headings, API examples, and field names are entirely presented in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific and documented as such.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill advertises compliance with GB/T 50500-2024, but `设置标准费率` explicitly says it applies rates based on 建标[2013]44号. In a construction-cost estimation context, this mismatch can systematically produce non-compliant or misleading estimates, causing downstream financial, contractual, or regulatory harm.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The implementation and examples reference enum members such as `CostCategory.专业工程费` that are not actually defined in the enum, which instead defines `专业工程`. This creates runtime failures and inconsistent category handling during import, calculation, and example execution, undermining reliability of cost outputs in a financial estimation tool.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The '触发场景' section lists generic activities such as '建设工程估算编制' and '造价构成分析' without defining explicit trigger phrases, boundaries, or non-trigger examples. In a markdown skill description, this can create ambiguous activation conditions and increase the chance of unintended invocation for ordinary construction-cost discussions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instruction activates on when the user asks to "create or build an estimate," but it does not define clearer scope boundaries, exclusions, or concrete trigger examples. In a markdown skill description, this broad phrasing can cause unintended invocation for loosely related estimation or planning requests.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The phrase "analyze or review an estimate" is broad and does not state what kinds of estimates are in scope or when the skill should not activate. Without narrower context or exclusions, this may match common conversational requests beyond the intended construction-cost domain.

Static analysis

No suspicious patterns detected.