eia-process-intel

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:53 AM UTC
• Version: 0.3.0

Overview

This markdown-only skill is a coherent EIA due-diligence workflow, with disclosed local ledger persistence but no hidden execution or exfiltration behavior found.

Use this skill for Chinese EIA due-diligence work where creating a project ledger is expected. Keep the eia-ledger directory in a private, access-controlled project area, avoid committing it to public repositories, and ask the agent to skip Phase 6 if you only want a read-only report.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

## 3. Cross-validation

- **Cycle-time method**: MBE units × growth time per wafer【示例值】 × annual effective hours → epitaxy capacity ceiling, vs. declared capacity
- **Material balance (material-balance method)**: GaSb substrate input vs. chip output → end-to-end yield range **18–26%【示例值】**. Caliber footnote: estimated under EIA-caliber self-consistency, not the true yield; understated substrates shift the real value away from this range
- **External checks**: permit execution report (pending); arsenic-waste transfer manifests (pending)
- status updates: capacity → cross-validated (cycle-time method, medium confidence); yield → cross-validated (material balance, medium confidence)

## 4. Inference summary

- Process route 【inferred】: T2SL cooled — MBE equipment fingerprint + arsine specialty gas + GaSb substrate, three evidence faces consistent

• Confidence: 70% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

## 3. Cross-validation

- **Cycle-time method**: MBE units × growth time per wafer【示例值】 × annual effective hours → epitaxy capacity ceiling, vs. declared capacity
- **Material balance (material-balance method)**: GaSb substrate input vs. chip output → end-to-end yield range **18–26%【示例值】**. Caliber footnote: estimated under EIA-caliber self-consistency, not the true yield; understated substrates shift the real value away from this range
- **External checks**: permit execution report (pending); arsenic-waste transfer manifests (pending)
- status updates: capacity → cross-validated (cycle-time method, medium confidence); yield → cross-validated (material balance, medium confidence)

## 4. Inference summary

- Process route 【inferred】: T2SL cooled — MBE equipment fingerprint + arsine specialty gas + GaSb substrate, three evidence faces consistent

• Confidence: 70% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The changelog states that the skill was rebuilt as an "English-primary" playbook and that the frontmatter was slimmed to a "single-language (English) description." This is a natural-language locale policy concern because it describes enforcing a specific language rather than offering users a choice.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README instructs users to invoke the skill with a very generic phrase ('帮我分析这个环评' / analyze this EIA report), which can overlap with ordinary document-analysis requests. In agent environments that auto-route based on trigger text, this can cause unintended activation on broad user prompts and expand the skill's reach beyond clearly consented use.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The English usage text ('analyze this EIA report' or drop the PDF) is underspecified and may match commonplace requests involving any uploaded document that appears EIA-related. In systems with heuristic skill selection, ambiguous invocation language increases the risk of the skill being triggered without the user understanding that it performs structured extraction, inference, and ledger-writing side effects.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill description/trigger set includes broad terms such as "EIA report," "equipment list," and "capacity verification," which are generic enough to match many unrelated enterprise, compliance, or industrial-analysis conversations. Over-broad invocation can cause the agent to activate this skill in contexts where the user did not intend environmental due-diligence analysis, increasing the chance of unnecessary data processing, irrelevant investigative behavior, and accidental propagation of high-confidence inferences from partial documents.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains only Chinese-language instructions and terminology, which can amount to a language/locale policy issue when no user opt-in or alternative language option is provided. The content does not indicate that the skill is region-specific or that Chinese is required for compliance or source-material constraints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The schema explicitly instructs users to store due-diligence facts, failed queries, and cross-case aggregation results in workspace files, but it provides no warning, minimization guidance, or controls for sensitive commercial/regulatory information. In the context of investment diligence, these records can contain non-public business intelligence and analyst inferences, so routine local storage increases the chance of unintended retention, sharing, or inclusion in version control.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The README states that the ledger is written to `{项目目录}/eia-ledger/<赛道>.jsonl` but does not warn the user that the skill will create or append files in the workspace. This creates a consent and integrity issue: users may expect analysis only, while the skill persists data and modifies project state.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The English usage section mentions where the ledger lives but does not explicitly disclose that using the skill causes file creation or appends in the user's project directory. Hidden persistence is risky because it can surprise users, pollute repositories, or store sensitive diligence data without deliberate approval.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The document includes Chinese text such as '示例值' inline in an otherwise English-language skill example, but does not state any language preference, user choice, or locale requirement. This can violate language/locale policy when a skill effectively imposes mixed-language output without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and examples only in Chinese, with no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: All user-facing instructions in this file are in Chinese, and there is no indication that the skill supports other languages or that Chinese is a deliberate, documented locale constraint. This can violate language or locale policy when users are not given an explicit choice or opt-in.

Static analysis

No suspicious patterns detected.