Security audit

analytics-dashboard

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only dashboard skill whose stated MCP access matches its purpose, with some documentation gaps users should notice.

Install only in an environment where the configured dashboard-mcp server is trusted and the user is authorized to view operational and tenant data. Treat returned tenant, event, health, and agent-status results as potentially sensitive, and ask the publisher to clean up the stray Cookie-management sentence and add clearer data-handling guidance.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 这是明显不匹配。描述声称该技能用于数据看板查询和获取实时/健康/租户等看板数据，但实际提供的代码并未执行任何看板查询、未调用 dashboard-mcp、也未访问相关系统或服务。其主要功能是对 SKILL.md 做静态文档完整性测试，因此代码的核心用途与声明的业务功能实质性不同。

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: L021 states the skill provides "/Cookie管理等能力", which conflicts with both the manifest description at L003 and the detailed workflow sections that limit the skill to dashboard queries. This is an active documentation contradiction about the skill's intended scope, not merely an omission.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest description lists triggers such as “实时统计”, “系统健康”, and “Agent状态”, which are generic operational phrases that could appear in ordinary user requests outside this specific skill. Although some exclusions are given, the trigger scope is still broad and does not clearly constrain when the skill should activate versus when another tool or general assistant behavior should handle the request.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: This markdown file describes access to operational dashboards, tenant overviews, recent events, and agent status, all of which may reveal sensitive system or tenant information. The document does not include any warning about data sensitivity, access expectations, or the need to avoid sharing results broadly.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This code file contains multiple natural-language docstrings, comments, and assertion messages only in Chinese, such as the autogenerated note and test descriptions. That effectively imposes a specific language on users or maintainers interacting with test failures, without offering a language choice or documenting a justified locale constraint.

Static analysis

No suspicious patterns detected.