Security audit

unit-converter

Security checks for vulnerabilities and agentic risk

Overview

This is a local unit-conversion skill with a documentation accuracy issue but no evidence of hidden, networked, persistent, or credential-seeking behavior.

Before installing, note that this skill is documented primarily in Chinese and that most unit inputs must use abbreviations like km, kg, or gb rather than Chinese names. It requests python3 through apt and otherwise appears to run fully locally without network access or persistence.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The overall primary purpose matches: it is a pure local unit converter covering the declared categories and does not use the network or extra permissions. However, the description specifically states support for Chinese and English unit names. In the code, non-temperature categories validate units strictly against abbreviation keys like km, m, kg, gb, ha, etc. Chinese unit names such as “千米” or “米” are not accepted as input. The NAMES mapping is only used to render output text, not to parse user-provided unit names. Only the temperature branch supports Chinese and English aliases like 摄氏度/华氏度 and ℃/℉. Therefore the description overstates multilingual input support, creating a meaningful description-behavior mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and the entire markdown content are written in Chinese, and the skill explicitly emphasizes Chinese support without indicating that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy because it imposes a specific language experience by default rather than offering opt-in or clearly justified scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This shell script presents its usage instructions entirely in Chinese and later emits Chinese-only error and result messages. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.