Security audit

eia-process-intel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed EIA due-diligence workflow that reads filings, performs structured analysis, and writes project-scoped ledger records; it has persistence users should understand but no hidden execution or exfiltration behavior was found.

Before installing or using it, decide where the DD project workspace should be and whether the agent may create or append eia-ledger files. Avoid running it on confidential PDFs unless persistent local records are acceptable, and review any cross-case or mapping-library updates before keeping them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Harmful Content Injection

Critical

Category: Prompt Injection
Confidence: 70% confidence
Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
Content: Scanner excerpt · examples/format-demo-ir-detector-en.md (reported line 35)May include surrounding context.
md
## 3. Cross-validation - **Cycle-time method**: MBE units × growth time per wafer【示例值】 × annual effective hours → epitaxy capacity ceiling, vs. declared capacity - **Material balance (material-balance method)**: GaSb substrate input vs. chip output → end-to-end yield range **18–26%【示例值】**. Caliber footnote: estimated under EIA-caliber self-consistency, not the true yield; understated substrates shift the real value away from this range - **External checks**: permit execution report (pending); arsenic-waste transfer manifests (pending) - status updates: capacity → cross-validated (cycle-time method, medium confidence); yield → cross-validated (material balance, medium confidence) ## 4. Inference summary - Process route 【inferred】: T2SL cooled — MBE equipment fingerprint + arsine specialty gas + GaSb substrate, three evidence faces consistent

Harmful Content Injection

Critical

Category: Prompt Injection
Confidence: 70% confidence
Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
Content: Scanner excerpt · examples/format-demo-ir-detector-en.md (reported line 50)May include surrounding context.
md
## 3. Cross-validation - **Cycle-time method**: MBE units × growth time per wafer【示例值】 × annual effective hours → epitaxy capacity ceiling, vs. declared capacity - **Material balance (material-balance method)**: GaSb substrate input vs. chip output → end-to-end yield range **18–26%【示例值】**. Caliber footnote: estimated under EIA-caliber self-consistency, not the true yield; understated substrates shift the real value away from this range - **External checks**: permit execution report (pending); arsenic-waste transfer manifests (pending) - status updates: capacity → cross-validated (cycle-time method, medium confidence); yield → cross-validated (material balance, medium confidence) ## 4. Inference summary - Process route 【inferred】: T2SL cooled — MBE equipment fingerprint + arsine specialty gas + GaSb substrate, three evidence faces consistent

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Chinese usage text instructs users to invoke the skill with a very generic phrase ('帮我分析这个环评') or by dropping an EIA PDF, without defining activation boundaries, scope checks, or explicit confirmation. In an agent ecosystem, broad triggers can cause unintended activation on routine conversation or unrelated document handling, which may lead the agent to ingest sensitive files, create persistent ledger artifacts, or perform high-trust analysis when the user did not clearly intend to run this workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The English invocation phrase ('analyze this EIA report') is generic and lacks any skill-specific namespace or boundary, making accidental triggering more likely in multi-skill or autonomous-agent settings. Because this skill performs structured extraction, inference, and append-only ledger writes, unintended activation could cause privacy-sensitive document processing, unwanted persistence, or cross-project contamination of due-diligence records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill metadata and description include very broad trigger terms such as '环评', 'EIA report', and 'equipment list', which can match many unrelated requests and cause unintended invocation. In this skill, unintended activation is more sensitive because the workflow encourages persistent writes to project files and ledger artifacts, so a spurious invocation can lead to unnecessary data extraction, storage, or investigative framing on content the user did not intend to process.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file's instructional content is entirely in Chinese and does not indicate that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The entire skill file is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains natural-language statements that the skill description was intentionally reduced to English-only, with the English document replacing a bilingual/mirrored setup. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a violation when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to append JSONL triples and create additional artifacts in the project workspace, but it does not prominently warn the user up front that running the skill may write investigation outputs to disk. This is risky because users may invoke what appears to be an analysis-only skill without realizing it performs persistent storage, potentially creating unwanted records, provenance logs, or sensitive due-diligence artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The document includes Chinese text such as '示例值' inline within otherwise English instructions, which imposes a language/locale assumption on users. The file does not state that the skill is intended specifically for Chinese-language EIA materials or offer an opt-in choice of language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file presents the skill content entirely in Chinese starting from the title, with no indication that users may choose another language or that the skill is limited to a Chinese-speaking or region-specific context. Under the policy for natural-language violations, a forced language/locale without user opt-in can be a compliance issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill document is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.