Security audit

Orchestration Reviewer Skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate local workflow-plan reviewer, but it overstates key safety checks and uses unpinned Python dependencies, so its results should not be treated as authoritative.

Install only if you need a lightweight advisory checker for local workflow-plan JSON. Do not rely on it as a security approval gate for executing workflows until dependency pins are added and expression, manifest-scope, and sensitive-field validation are implemented or independently enforced by the workflow engine.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:145
Finding: Unpinned and Unnecessary Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/input_schema.json:33
Finding: Executable Condition Expressions Bypass the Documented Security Guardrail
Content: View full analysis
dict: schema_file = schema_path or SCHEMA_PATH with open(plan_path) as f: raw = json.load(f) plan = _extract_plan_ir(raw) try: import jsonschema with open(schema_file) as f: schema = json.load(f) errors = [] try: jsonschema.validate(plan, schema) except jsonschema.ValidationError as e: errors.append(str(e.message)) return {"schema_valid": len(errors) == 0, "errors": errors} except ImportError: return _basic_validate(p ...[truncated 2764 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/review_plan.py:23
Finding: Manifest Scope Restrictions and Sensitive State Keys Are Not Enforced
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明强调的是对工作流计划进行结构化评审，包括给出结论、发现问题、提出修订建议，整体定位是审核/审查工具。而代码并没有实现任何评估逻辑、规则检查、质量判断或建议生成；它只是读取两个 JSON 计划文件，按 node_id 比较节点集合，并报告新增、删除和部分字段修改。因此其主要行为与‘评审工作流计划’存在实质偏差。虽然声明中提到‘对比多个编排版本’，这与代码的一部分行为相符，但代码能力明显窄于且不同于核心声明：它是一个版本 diff 工具，不是评审器。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个较完整的“结构化评审”能力，预期输出应包含评审结论、问题清单和修订建议，并可用于对比多个编排版本。实际代码仅实现了单个 Plan IR 的启发式评分器：检查目标关键词覆盖、拓扑可达性、技能绑定、作用域字段完整性、可执行性、复杂度/并行度、风险治理等，然后给出 scorecard、weighted_score 和 decision。它没有识别并列出具体问题，也没有生成修订建议，更没有实现多版本对比逻辑。因此虽然与“审查计划合理性”这一大方向相关，但其主要行为显著窄于声明，属于描述与实际行为不完全一致的情况。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明的核心能力是对工作流计划进行审查与评审，产出评审结论、问题清单和修订建议，这通常意味着超出纯结构验证的质量、合理性或设计层面的分析。而实际代码的功能非常有限：它只是读取 JSON，提取 Plan IR，并使用 jsonschema 或简单必填字段检查来验证结构是否符合 schema。输出也仅包含 schema_valid 和 errors，属于输入校验工具，而非评审工具。虽然 schema 校验可作为评审流程中的辅助步骤，但这里它构成了代码的主要且几乎唯一行为，与声明的主要用途存在实质偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较广义的“工作流计划结构化评审”能力，预期包括评审结论、问题清单和修订建议，适用于审查 DAG、编排方案合理性，甚至对比多个编排版本。实际代码则明显更窄：它只从输入中提取 Plan IR，检查是否有节点、识别入口节点、验证非入口节点是否声明 scoped_state_keys，以及检查 input_mapping 是否引用已声明的节点作用域键。输出也仅限于 scope_valid、errors、warnings，并没有实现综合评审、合理性分析、版本对比或修订建议生成。因此其主要能力与声明的广泛评审用途存在实质性偏差，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较完整的工作流计划评审器，应对 Plan IR 做结构化审查并给出评审结论、问题清单和修订建议，且适用于更广泛的“计划合理性检查/编排方案审核/版本对比”。但实际代码只是一个单一的 DAG topology validator：它只检查空图、多节点无边、边是否引用存在节点、是否有环、入口节点一致性告警，以及粗略深度计算。它不会输出修订建议，不会进行更广义的计划合理性分析，也不会比较多个版本。因此主用途与声明存在实质性差异：代码实现的是“拓扑校验子功能”，不足以覆盖所宣称的“结构化评审”能力。虽然拓扑校验可视为评审的一部分，但这里差距较大，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents commands and workflow behavior that can write output files (for example via --output review_result.json) but does not declare any explicit tool scope such as permissions or allowed tools. This creates an authorization/governance gap: a caller or hosting platform may permit broader file-write behavior than users or reviewers expect, increasing the risk of unintended overwrites or misuse of local filesystem access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description and the main skill documentation are written entirely in Chinese, and the invocation examples are also Chinese-centric. There is no natural-language indication that users may interact in other languages or that the skill is intentionally limited to a Chinese-language context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This JSON file contains user-facing natural-language content entirely in Chinese across the business goal, node purposes, and skill descriptions. Because the file provides no opt-in, alternative locale, or justification that this is a region-specific workflow, it may violate the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JSON contains multiple user-facing natural-language fields in Chinese, including the review summary, issue descriptions, and suggestions. For a general sample review output, forcing a specific language without opt-in or justification is a locale policy concern under the natural-language policy rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains the operational review instructions primarily in Chinese, but it does not state that the skill is China/Chinese-specific or provide any user language choice. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains all substantive review instructions in Chinese, but does not indicate that the skill is region-specific or provide any user opt-in for language selection. That can violate language/locale policy when users may reasonably expect skill guidance in their preferred language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains core scoring-policy instructions exclusively in Chinese, which can impose a language constraint on users or reviewers without opt-in. The policy does not indicate that Chinese is optional, nor does it justify a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code includes user-facing natural-language strings in Chinese for issue classification comments and, more importantly, suggested action messages later in the returned result. Because the skill does not offer a language choice or document a justified locale constraint, it violates the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and function docstring describe this script as a review/validation runner that collects results, but the final issues field does not preserve the collected issue descriptions. critical_issues and major_issues are already dicts, yet lines L071-L076 wrap them again under description, so the output contains nested dicts rather than the actual error/warning text, contradicting the intended review-report behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The suggested_actions field returns Chinese-only guidance strings regardless of user preference or environment. This is a natural-language policy violation because the skill forces a specific language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all substantive operational guidance in Chinese, with no indication that language selection is optional or configurable. Under the language/locale policy rule, a skill document that effectively forces a specific language without user opt-in can be considered a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON file includes a natural-language instruction in Chinese: "进行语义评审（LLM 主导的 7 维度评审）". Because the file does not offer a language choice or explain a locale-specific requirement, it appears to impose a specific language without user opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains natural-language text in Chinese in the docstring and multiple inline comments, such as the extraction docstring and scoring-step comments. Under the stated policy, forcing a specific language or locale without user choice or a documented region-specific reason can be a policy violation; this file provides no opt-in or justification for the language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code includes natural-language strings in Chinese in the docstring and comments, but the file provides no indication that the skill is region-specific or that users can opt into a Chinese-only experience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code file contains natural-language text in Chinese in the function docstring, while the rest of the file and CLI output are in English. That creates an implicit language constraint without any opt-in or justification, which matches the policy concern for forced language/locale usage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains a natural-language comment/docstring in Chinese while the rest of the file and CLI output are in English. That imposes a language assumption on maintainers or reviewers without any stated opt-in or documented locale-specific justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.