Security audit

事实核查助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This fact-checking skill is not clearly malicious, but it asks for broad command and data-handling authority that is not tightly scoped for a simple claim-verification tool.

Install only if you are comfortable with a Markdown-only fact-checking skill that may use shell-based web retrieval and may save claim history. Avoid sending private drafts, personal communications, credentials, or sensitive claims unless the agent environment gives you clear control over execution, storage, and deletion.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is framed as a simple fact-checking assistant, but it declares `exec` and documents shell-style operations that are broader than necessary for claim verification. In an agent environment, unnecessary command-execution capability expands the attack surface and can enable misuse, prompt-injection-driven command execution, or unintended local system/network interaction.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The documentation says the skill connects to fact-checking institutions, but also states that execution uses generic `input_params` supporting create/query/export operations and persistent history behaviors. This mismatch increases the chance that downstream agents grant the skill broader authority than users expect, enabling data handling or state-changing actions unrelated to simple fact verification.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation guidance is overly broad, effectively suggesting use whenever AI model calling, orchestration, or LLM applications are involved. Ambiguous routing criteria can cause this skill to be invoked in inappropriate contexts, increasing exposure to unrelated inputs and making dangerous tool use more likely in workflows that do not actually need fact-checking behavior.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The keyword-based capability coverage section defines an expansive and vague trigger surface, including generic terms like 'Use', 'Agent', and 'LLM'. In agent systems, such broad matching can lead to over-triggering, causing the skill to run in unintended contexts where its tools, persistence, or command-execution pathways create unnecessary risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill supports saving fact-check history but does not provide a clear warning about what user content is stored, how long it is retained, or whether sensitive claims may be persisted. Because fact-check inputs can include private articles, drafts, or personal communications, silent or poorly disclosed retention creates privacy and data-governance risk.

Static analysis

No suspicious patterns detected.