Security audit

qingtian-psyche-scale-assessment

Security checks for vulnerabilities and agentic risk

Overview

This is a local mental-health self-assessment tool, but it needs review because some suicide-risk answers may not trigger the promised crisis help and sensitive reports are saved locally.

Install only if you are comfortable using a Chinese-language self-screening tool that saves HTML reports locally. Treat results as informational, not diagnosis or treatment. Before using it for depression or broad symptom screening, the publisher should add crisis triggers for all suicide/death-related items and make local report saving opt-in or clearly confirmed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (55)

Missing User Warnings

High

Confidence: 99% confidence
Finding: The safety section explicitly contains empty crisis_items, crisis_rule, and high_risk_rule fields for a depression assessment. Because this is not merely missing optional metadata but an unimplemented safety control in a high-risk domain, the skill may fail open and handle crisis disclosures as normal questionnaire data.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The questionnaire includes severe symptom content such as feeling terrified, fearing going crazy, fainting-like episodes, and significant somatic distress, yet the safety block leaves crisis_items, crisis_rule, and high_risk_rule empty. In a psychological self-assessment context, missing escalation logic can result in the system failing to surface urgent help instructions when a user presents high-acuity distress, increasing the chance of harmful delay.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The scale includes an explicit self-harm item (q15: '想结束自己的生命') but marks it with "crisis": false and provides no escalation metadata. In a mental-health screening skill that claims highest-priority crisis intervention and crisis detection, this can cause suicidal disclosures to be handled as routine questionnaire data rather than triggering immediate safety messaging or escalation.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A suicide-related question is present without any crisis flag, warning, or escalation metadata. Because this is a self-assessment tool in a sensitive mental-health context, failure to specially handle affirmative responses materially increases the risk that a user in crisis receives a normal report instead of urgent help instructions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The item about thinking about death (q59) is crisis-relevant but lacks any warning or escalation metadata. While less specific than an explicit suicide-intent item, in this skill context it is still an important risk signal that should contribute to safety handling rather than being treated as ordinary symptom scoring only.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file's "safety" block is effectively empty despite the presence of suicide-, death-, psychosis-, and violence-related questions and despite the skill description claiming generic crisis detection support. This creates a gap where the scoring/report pipeline may have no machine-readable instructions to detect or escalate crisis responses for this scale.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The global safety configuration is empty even though the questionnaire contains multiple crisis-relevant prompts. In a mental-health assessment product, the absence of structured safety controls undermines claimed guardrails and can systematically fail to detect or respond to users expressing suicidal or dangerous thoughts.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The SDS includes item q19 ('假若我死了别人会过得更好'), which is a clear suicidality-adjacent indicator, yet the file leaves safety.crisis_items, crisis_rule, and high_risk_rule empty and does not mark the item itself as crisis-related. In a mental-health screening skill that explicitly claims highest-priority crisis intervention guardrails, this omission can cause high-risk responses to be scored and reported without escalation, delaying urgent safety messaging or referral.

Missing User Warnings

High

Confidence: 98% confidence
Finding: A suicidality-related prompt is present, but there is no accompanying machine-readable safety metadata to tell downstream components that the response requires special handling. In this skill context, the absence of structured warning and crisis logic is especially dangerous because users may disclose self-harm risk during screening and receive only routine interpretive output instead of immediate protective guidance.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README states that psychological assessment reports are saved to disk by default, but it does not warn users that these reports may contain highly sensitive mental-health data. On shared machines, synced folders, backups, or improperly permissioned directories, this can lead to unintended disclosure of private health information.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to read scale files and write HTML reports to a local reports/ directory, but it does not declare any explicit tool scope or allowed-tools policy. That mismatch weakens least-privilege controls and can let a host agent expose broader file access than the skill actually needs, increasing the blast radius if the skill is misused or later modified.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The activation phrases include very broad terms like '启动', '开始', and 'start', which are common conversational words. In a multi-skill environment this can cause accidental invocation, unexpectedly collecting highly sensitive mental-health responses or starting report-generation flows without the user clearly intending to use this specific skill.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger scenarios include broad natural-language requests like '测一下我的焦虑/抑郁/压力/睡眠' and generic requests to generate a report, without clear constraints or confirmation gates. Because this skill handles sensitive psychological data, ambiguous triggers raise the risk of misrouting ordinary conversation into a structured screening workflow and eliciting sensitive disclosures unintentionally.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: L100 says the HTML report is generated and saved to `reports/` as part of the normal flow, while L101 then says to ask the user whether to save it locally. These instructions actively contradict each other on a sensitive behavior involving persistence of mental-health assessment data.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: All user-facing natural-language content in the file is presented in Chinese, including the prescribed dialogue trigger and report description, without any indication that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The sample usage says users can trigger the skill by simply saying “启动”, which is an extremely generic phrase likely to appear in ordinary conversation and could invoke the skill unintentionally. In a mental-health assessment context, accidental activation is more concerning because it may start collecting sensitive psychological self-report data or steer the conversation into crisis workflows without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The emergency-help section is explicitly scoped to China and provides only China-specific hotlines, while the file does not offer a locale choice or explain how users in other regions should proceed. This creates a natural-language locale policy issue because the guidance is effectively fixed to one country without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file presents all instructions and warnings only in Chinese, which effectively forces a specific language/locale on users. The policy allows locale constraints only when user choice is offered or the restriction is clearly documented and justified, neither of which appears here.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This scale file interprets psychological self-report results and provides advice bands, but its embedded safety section is effectively empty and there is no user-facing disclaimer in the file content indicating that the result is only a screening aid, not a diagnosis, nor any crisis-routing guidance. In a mental-health assessment context, users with elevated distress may over-trust the output or fail to seek urgent help, making omission of clear warnings and escalation language a real safety weakness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This file defines a depression screening instrument with risk bands and a severe life-continuation item, but the manifest itself does not embed any user-facing warning, limitation, or crisis guidance. In this skill context, omission of safety messaging increases the chance that distressed users treat the output as sufficient without being prompted to seek urgent help when needed.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The CES-D manifest includes a severe item, q20 ("我无法继续我的生活"), which can indicate acute self-harm or suicidality risk, yet the safety configuration leaves crisis detection empty. In a mental-health screening skill, failing to flag and route such responses can suppress urgent escalation and produce an ordinary report for a user who may need immediate crisis guidance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This scale collects sensitive mental-health-adjacent relationship data and provides interpretive bands and advice, but the file itself contains no embedded user-facing warning, emotional support notice, or clear escalation guidance. In this skill context, omission of such safeguards can mislead distressed users into over-trusting self-assessment output or continuing without support when content becomes upsetting.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: This appears to be a real integrity issue in the questionnaire definition. The file explicitly states the scale contains reverse-scored items, and ob2 is negatively worded ('我注意不到很多我正在经历的情绪和感觉') yet is marked reverse=false, which can systematically distort the '观察' dimension and overall interpretation. In a mental-health assessment skill, scoring errors are more dangerous than in generic survey content because they can produce misleading self-assessment results and inappropriate feedback.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This is a real safety issue for a mental-health questionnaire file because the scale metadata lacks an explicit user-facing disclaimer that results are screening or self-reflection information only, not diagnosis or treatment advice. In this skill context, absence of that warning can increase overreliance on generated results, especially if the report is rendered as polished HTML and may appear authoritative.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The scale description presents a mental-health screening tool but does not itself include a user-facing warning that the result is only a screening aid, not a diagnosis, and that urgent distress requires immediate professional or emergency help. In a mental-health context, omission of that disclaimer can cause users to over-trust self-assessment output and delay appropriate care.

Static analysis

No suspicious patterns detected.