Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed verification-document generator and auditor, with workspace file outputs and optional large-batch subagents, and I found no hidden network, credential, persistence, or destructive behavior.
Install only if you are comfortable letting the agent read requirement and VC documents in the workspace, create split and merged output files, and use subagents for large batches. Confirm output paths before generation, review any generated safety-critical verification criteria with qualified engineers, and prefer incremental updates when existing VC files are detected.
The skill description understates preprocessing and orchestration capabilities such as regex-based requirement extraction, markdown splitting, and file-generation workflows. Hidden or undeclared operational behaviors expand the attack surface and can lead to misuse, especially when users assume the skill is limited to analytical review rather than manipulating project files.
The skill description understates preprocessing and orchestration capabilities such as regex-based requirement extraction, markdown splitting, and file-generation workflows. Hidden or undeclared operational behaviors expand the attack surface and can lead to misuse, especially when users assume the skill is limited to analytical review rather than manipulating project files.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Normal | {no fault} | No warning/action | {duration} | 25°C |
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Normal | {no fault} | No warning/action | {duration} | 25°C |
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Test Scenario | Fault Condition | Expected Behavior | Criterion | Temperature |
|--------------|----------------|-------------------|-----------|-------------|
| Normal | {no fault} | No warning/action | {duration} | 25°C |
| Marginal-Pass | {borderline, just above threshold} | No warning/action | {duration} | 25°C |
| Marginal-Fail | {borderline, just below/above threshold} | Warning/action | {time limit} | 25°C |
| Severe Fault | {deep into fault zone} | Warning/action | {tighter time limit} | 25°C |
| Gradual Degradation | {slowly crossing threshold} | Correct threshold detection | {consistency} | 25°C |
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Test Scenario | Fault Condition | Expected Behavior | Criterion | Temperature |
|--------------|----------------|-------------------|-----------|-------------|
| Normal | {no fault} | No warning/action | {duration} | 25°C |
| Marginal-Pass | {borderline, just above threshold} | No warning/action | {duration} | 25°C |
| Marginal-Fail | {borderline, just below/above threshold} | Warning/action | {time limit} | 25°C |
| Severe Fault | {deep into fault zone} | Warning/action | {tighter time limit} | 25°C |
| Gradual Degradation | {slowly crossing threshold} | Correct threshold detection | {consistency} | 25°C |
The trigger phrases are broad enough to overlap with ordinary user requests such as 'generate', 'audit', 'review', or 'coverage', which can cause the skill to activate when the user did not intend to invoke this specialized workflow. In an agent ecosystem, unintended activation can override the expected task flow, introduce unexpected constraints or outputs, and cause the agent to process sensitive requirement artifacts under the wrong mode.
Stating that the skill 'auto-routes based on your phrasing' without clear boundaries or exclusions creates ambiguous invocation behavior, making it easier for unrelated prompts to be captured by this skill. In multi-skill agents, this can lead to prompt routing confusion, unintended file handling, and loss of user control over which skill governs the response.
Suspicious Unicode normalization or mixed-script content
The skill instructs file reads, file writes, and script execution patterns but does not declare any explicit tool scope or allowed-tools boundary. That creates a capability gap where the runtime may permit broader filesystem actions than users or reviewers expect, increasing the risk of unintended file access or modification during operation.
The markdown instructs users through Chinese table headers and Chinese trigger phrases, while the skill overall also contains English content. There is no explicit statement that the user may choose their preferred language or locale, so the skill effectively imposes a language mode without opt-in.
Directing execution of local scripts and parallel subagents broadens the trust boundary beyond a simple VC-analysis skill. If those scripts or subagent prompts are modified, unsafe, or operate on untrusted files, the skill can become a vehicle for unintended code execution, excessive file access, or opaque automated actions.
Lines L17-L27 contain substantial natural-language guidance in Chinese within an otherwise English document. Under the language/locale policy rule, forcing a specific language without user opt-in or documented justification is a policy concern because some users may be unable to understand key instructions.
This markdown file contains operational instructions exclusively in Chinese, including user-facing fallback behavior and decision prompts. Because no opt-in, alternative language option, or justified region-specific scope is stated, it may violate organizational language/locale policy requiring user choice.
The document is written as mandatory operating instructions for a sub-agent and states that the sub-agent must execute the gates one by one, but it provides those instructions only in Chinese. This creates a language/locale constraint without any opt-in or alternative language option, which matches the policy's language-choice concern.
This markdown file contains user-facing instructions and examples exclusively in Chinese, including mandatory formatting requirements and self-check steps. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
The markdown template contains Chinese-only instructional text in line L22 and line L29, which imposes a specific language/locale in a generally applicable report template. There is no indication that the template is region-specific or that users may choose their preferred language, so this is a natural-language policy violation.
Suspicious Unicode normalization or mixed-script content
This markdown file is written entirely in Chinese and provides procedural guidance without any indication that the language choice is optional or region-specific. Under the policy rule, a skill that effectively requires a specific language without user opt-in can be a natural-language policy violation.
Line L18 hard-codes forbidden words in Chinese and English and requires an automatic failure if any appear. This imposes a language-specific policy on skill outputs without stating that the skill is limited to those languages or giving users an opt-in choice.
This markdown file contains core procedural guidance in both English and Chinese, including examples and decision logic later in the document. Under the stated policy, forcing or assuming a specific language without user opt-in or a documented regional justification can be a natural-language policy violation.
The file is written as an operational prompt template in Chinese and directs the sub-agent through Chinese-only task headings and constraints, but it does not provide any user or operator choice of language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
This JSON file is a manifest-like test prompt set, so SQP-1 applies. Multiple prompts use broad natural-language requests such as "请生成 VC" and "请评分并指出问题" without any explicit trigger constraints, exclusion conditions, or negative examples, which could overlap with ordinary conversation and make activation boundaries unclear.
The file’s natural-language content consistently assumes Chinese-language interaction and expected outputs, including mandatory behavior descriptions in Chinese. This can violate language/locale policy if the skill forces a specific language without offering the user a choice or documenting a justified locale restriction.
The file repeatedly requires IDE-specific interaction and task-management tooling as a hard rule, including mandatory question prompts and todo-list management. Those capabilities are workflow-control features of an agent environment, not intrinsic to generating or auditing verification criteria as described in the manifest.
No suspicious patterns detected.