album-review

• Outcome: Pass
• Latest audit: Sep 28, 2026 · 3:02 AM UTC
• Version: 0.3.0

Overview

This is a disclosed Chinese album-review skill with read-only validation scripts and no evidence of hidden persistence, exfiltration, destructive actions, or privilege escalation.

Install this only if you want a Chinese long-form album-review workflow that may use web/search tools for research. Review the mutable npx install source before installing, and remember that the validators check length and reference structure, not whether the review is substantively good or every cited source truly supports the prose.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a content-generation skill: produce a comprehensive Chinese album review from a music credit plus album name. The supplied code does not generate any review text or critique. Its primary function is enforcement/QA: counting CJK characters, checking for required section markers, optionally validating backing JSON evidence, and returning violations. It also adds a separate route-classifier to detect hifi-review and other out-of-scope requests. While these behaviors are related to album-review workflows, they are materially different from the declared primary purpose and include undeclared capabilities (linting, file/schema validation, routing). Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is a music-review generation skill focused on comprehensive Chinese album criticism. The supplied code does not perform any text generation, music analysis, source tracing, album/artist handling, or trigger logic related to reviews. Instead, it validates JSON instances against schemas and reads files from disk. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill should produce a comprehensive Chinese album review based on a named musical credit and album. The supplied code does nothing related to review generation, music criticism, Chinese-language output, or handling those triggers. Instead, it validates a JSON backing document against a schema and checks that fact claims include valid source_ids present in evidence. This is a materially different primary purpose: internal data validation for source traceability, not end-user album reviewing. The read-only file access is consistent with the script’s actual behavior, but that behavior itself is not what was declared.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

to the prior `SKILL.md` + `scripts/`.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains natural-language text calling out README wording as '"强制" / "requires"', which indicates the skill documentation may mandate Chinese output. A forced language/locale requirement without user opt-in matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README repeatedly states that the skill produces a Chinese review, including "One full-dimension long-form Chinese 乐评" and "One 10,000–15,000-字 Chinese 乐评," but does not indicate that users may choose another language. A fixed language requirement without opt-in can violate language/locale policy expectations unless clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase "全面评测这张专辑" is broad and lacks explicit constraints on review depth, language, or required inputs, making it easier to collide with ordinary conversation about albums. Although other examples are specific, this example weakens trigger precision for a markdown skill description.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 19)May include surrounding context.

md

**When to use** — "给 <artist/composer/conductor> 的专辑 <name> 写一篇深度乐评" · "全面评测这张专辑" · "comprehensive album review of <album> by <artist>"; or call `/album-review`.
**Not for** — audio-gear evaluation ("这条耳机声音怎么样", "这个 DAC 推得动吗" → hifi-review); buying / price / where-to-stream advice; bare lyric translation with no critical content; non-music subjects.

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/album-review ~/.claude/skills/`).

**Version** — 0.3.0 (2026-09-25). Changes and verification record: [CHANGELOG.md](CHANGELOG.md).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The installation command uses npx skills add VincentJiang06/skills without pinning an exact package/version, which can pull whatever version is current at execution time. That creates a supply-chain risk: users may install changed or compromised code unexpectedly, and the README context encourages direct execution from the command line.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README repeatedly states that the skill produces a long-form Chinese album review, including '长篇中文乐评' and '产出一篇 10,000–15,000 字的中文乐评'. This is a natural-language locale restriction presented as a requirement, and the file does not indicate that users may opt into another language or choose their preferred locale.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

**什么时候用** —— 「给 <艺术家/作曲家/指挥家> 的专辑 <名称> 写一篇深度乐评」·「全面评测这张专辑」·「comprehensive album review of <album> by <artist>」；也可用 `/album-review` 显式调用。
**不适用** —— 音频器材评测（「这条耳机声音怎么样」「这个 DAC 推得动吗」→ hifi-review）；购买 / 价格 / 在哪听的建议；只译歌词、无乐评内容；非音乐主题。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/album-review ~/.claude/skills/`）。

**版本** —— 0.3.0（2026-09-25）。改动与验证记录见 [CHANGELOG.md](CHANGELOG.md)。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

**什么时候用** —— 「给 <艺术家/作曲家/指挥家> 的专辑 <名称> 写一篇深度乐评」·「全面评测这张专辑」·「comprehensive album review of <album> by <artist>」;也可用 `/album-review` 显式调用。
**不适用** —— 音频器材评测(「这条耳机声音怎么样」「这个 DAC 推得动吗」→ hifi-review);购买 / 价格 / 在哪听的建议;只译歌词、无乐评内容;非音乐主题。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/album-review ~/.claude/skills/`)。

**版本** —— 0.3.0(2026-09-25)。改动与验证记录见 [CHANGELOG.md](CHANGELOG.md)。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description requires producing the review in Chinese and explicitly locks output measurement to CJK characters only. This is a natural-language locale constraint presented as mandatory behavior, with no opt-in or alternative language path for users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON example includes multiple natural-language fields in Chinese while the surrounding metadata and labels are in English, suggesting a fixed output language choice. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction states that the final article must be 10,000–15,000 Chinese characters, which imposes a specific language requirement. This is a natural-language policy concern because the template does not offer any language or locale choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Line L03 requires the review to be written in '中文字符 (CJK 汉字 only)', which forces a specific language/locale. This is a natural-language policy concern because the file does not provide user opt-in, alternatives, or a documented regional justification for the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The protocol explicitly requires emitting Chinese phrases such as "资料不足" / "公开资料有限" and further states that the validator counts only 汉字. This imposes a specific language/locale on outputs with no user opt-in or documented region-specific justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says the backing is emitted alongside the prose "乐评", which implies a Chinese-language review context, but the file does not clearly state that this locale is optional or user-selected. That creates a natural-language policy concern because it appears to enforce a specific language without explicit opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest/config-style JSON file, so SQP-1 applies. The language field permits "zh", "en", and "bi" but provides no trigger conditions, defaults, or negative examples describing when each should be selected, which can lead to ambiguous activation of language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring explicitly defines the review QA in Chinese terms and requires counting only CJK Han characters, while the enforced section keywords throughout the file are Chinese-only. This imposes a specific language/locale constraint in natural-language behavior without offering a language choice or stating a justified region-specific policy scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Line L30 says missing facts should be made explicit as '资料不足 in the prose', which imposes a specific language in the generated output. This is a natural-language policy concern because the file does not state that Chinese should be used only when the user requests it or in a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs the unit of analysis using Chinese terms in parentheses ("逐曲 vs 逐乐章 vs 逐碟"), which creates an implicit locale preference in the skill guidance. Because the file does not state that multilingual output is optional or user-selected, this can conflict with a language/locale policy requiring user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The instruction to include a "reference-recording / 版本比较" section embeds Chinese-language terminology into the expected content structure. Without any explanation that this skill is intended for bilingual or Chinese-language use, this appears to impose a locale-specific convention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.