Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
content-final-supervisor
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Chinese-language content final-review workflow that routes review material to a configured quality-supervisor MCP service, with no hidden install behavior or local persistence found.
Install this only when you trust the configured quality-supervisor-mcp service, because scripts, storyboards, video URLs, supervision history, redo requests, and arbitration decisions may be sent there. Consider narrowing activation phrases and requiring explicit confirmation before automatic redo or final arbitration in production workflows.
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
- This is a clear mismatch because the declared purpose describes an operational content final-supervision skill, but the provided code only implements documentation smoke tests for the skill's markdown file. Its primary purpose is materially different from the description, and none of the advertised supervision behaviors or external service connections are present.
Vague Triggers
Medium
- Confidence
- 93% confidence
- Finding
- The description declares triggers such as "终检", "质量监督", and "supervise", which are generic terms rather than narrowly scoped invocation phrases. The file does not provide exclusion conditions or negative examples, so the activation boundary is unclear and could cause unintended invocation in ordinary quality-review contexts.
Missing User Warnings
Medium
- Confidence
- 90% confidence
- Finding
- The markdown describes sending script content, storyboard content, video URLs, and supervision context to quality-supervisor-mcp across multiple steps, including history lookup, redline checking, redo, and arbitration. However, it does not visibly warn users about external transmission of potentially sensitive production content or review metadata, which is relevant to privacy and system integrity.
Natural-Language Policy Violations
Medium
- Confidence
- 80% confidence
- Finding
- The file is entirely written in Chinese and presents mandatory business rules for the skill, but nowhere indicates that language selection is optional or that the skill is intentionally restricted to a Chinese-only operating context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Natural-Language Policy Violations
Low
- Confidence
- 92% confidence
- Finding
- This markdown file presents all user-facing documentation and error-handling guidance exclusively in Chinese, with no indication that another language is available or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Natural-Language Policy Violations
Low
- Confidence
- 90% confidence
- Finding
- This markdown file presents all instructional and example content in Chinese only, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Natural-Language Policy Violations
Low
- Confidence
- 94% confidence
- Finding
- This Python file contains multiple natural-language strings in Chinese for generated metadata, comments, and test descriptions, with no indication that language selection is optional or justified by a region-specific requirement. The policy explicitly calls for flagging language or locale constraints when the skill appears to force a specific language without user opt-in.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
# 业务规则 - content-final-supervisor > 来源: skills/content-final-supervisor/SKILL.md (来源: B3-03修复 R-91/R-86/R20/R72.2) ## 规则列表
- Confidence
- 24% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
# 错误码定义 - content-final-supervisor > 来源: skills/content-final-supervisor/SKILL.md 异常处理表 ## 错误码列表
- Confidence
- 24% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
# 示例 - content-final-supervisor > 来源: skills/content-final-supervisor/SKILL.md 示例章节 ## 示例1: 全链终检通过
- Confidence
- 24% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Static analysis
No suspicious patterns detected.