Professional-Engine Suite

• Outcome: Review
• Latest audit: Oct 13, 2026 · 12:40 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs review because it can run user-supplied Python files and allows user-added content to affect high-stakes workflows.

Review before installing. Use the Python helper scripts only on files you trust or inside a sandbox, because supplied Python modules will execute locally. Treat outputs as structured analysis aids, not medical, legal, or investment advice, and tightly control any user-added reference material that becomes part of future skill behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a sophisticated cross-domain reasoning/meta-skill system for medicine, finance, law, engineering, and formal verification workflows. The supplied code does none of that. Instead, it implements a narrow developer tool for measuring execution time of a Python function over multiple input sizes and inferring approximate algorithmic complexity from a log-log slope. This is a materially different primary purpose. While complexity analysis could loosely relate to computer science or engineering, the declared behavior is far broader and focused on auditable domain reasoning, not empirical benchmarking of code. The code also executes an externally supplied Python file via importlib, which is an operational capability not reflected in the description. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个大型、跨专业领域的推理/验证元技能系统，覆盖医学、金融、法律、工程和形式验证等复杂任务，并带有统一的方法论约束。实际给出的代码则仅实现了一个非常具体的小工具：在有限输入空间上对布尔谓词进行穷举或随机测试以寻找反例。虽然“形式验证/双通道验证”字样与反例搜索在非常宽泛的意义上有一点关系，但该代码既不支持所宣称的大多数专业领域能力，也没有实现描述中强调的审计、置信、拒答、规范查询等核心机制。其主要目的与声明明显不一致，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该描述与代码存在明显的描述-行为不一致。代码功能非常具体且狭窄：解析形如 kg*m/s^2 与 N 的单位表达式，并判断量纲是否相同。这可以被视为工程/物理领域中的一个小型支持性检查工具，但远不足以支撑所宣称的“四册五引擎”专业推理系统。代码没有医学、投资、法律分析能力，也没有形式证明、设计权衡、规范查询、证据综合、置信输出或拒答策略等实现。因此其主要目的与声明严重不符，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code implements one specific engineering-related numerical method: fourth-order Runge–Kutta integration for ODEs with a crude error estimate via step halving. It does not implement the claimed four-volume/five-engine professional system, nor any medical evidence grading, investment valuation, legal rule comparison, formal methods workflow, confidence semantics, dual-channel audit framework, or refusal handling. While an ODE solver could be a supporting component of an engineering/physics engine, this chunk by itself materially underdelivers relative to the declared primary purpose and trigger scope. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

代码的核心功能非常明确：读取一个 Python 文件和一个 spec.json，提取函数定义后检查函数名、参数名、返回注解是否与规约一致。这属于软件接口/签名一致性校验工具。相比之下，声明描述的是一个大型跨领域专业推理引擎系统，涉及医学、金融、法律、工程和形式化验证等复杂能力。两者在主要用途、能力边界、触发场景上均严重不一致。虽然描述中提到“可审计”“双通道校验”等抽象词汇，但代码并未实现任何相应的专业推理框架，仅完成简单的静态签名比对，因此应判定为明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

该代码块的功能非常具体且有限：它读取一个文件，提取形如 [Uxx] 或 [L2-领域-xx] 的引用，并验证编号范围和领域名是否合法。这可以勉强视为“工程册”中‘可审计链条’的一小部分辅助工具，但远不足以支撑声明中所描述的完整技能。声明将技能表述为覆盖多个高代价专业领域的综合推理系统，而实际代码既不进行专业推理，也不进行医学、投资、法律或形式验证计算，仅执行简单的正则匹配和白名单校验。因此描述与代码实际行为存在显著不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The primary display name is set in Chinese while the skill is marked user-invocable, and the document does not state that language selection is optional or based on user preference. This can create a locale/language policy issue because the skill appears to default to a specific language without documented user opt-in or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is extremely broad and includes common professional terms that can overlap with ordinary requests. In a skill with WebSearch, Bash, file access, and high-stakes domain framing, overbroad triggering can cause the skill to activate unexpectedly, apply the wrong workflow, or present overconfident specialized handling where the user did not intend it.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that no modification to skill content is permitted, then immediately allows users to append and upgrade content in requirements, guard lists, and exemplars. In a high-stakes skill, this contradiction can let untrusted users inject authoritative-looking rules, examples, or guardrails that later executions may treat as trusted context, undermining integrity and potentially steering outputs in unsafe directions.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill file is written exclusively in Chinese and does not indicate that language choice is optional or configurable. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file is entirely authored in Chinese and presents output requirements and examples only in Chinese, with no indication that language should follow the user's preference or locale. In a legal-routing skill, forcing a single language can cause misunderstandings, missed disclaimers, or incorrect task routing when users interact in another language, which is especially risky in high-stakes domains.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire template is written as Chinese-only operational guidance and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

该文件全文以中文撰写，且未见任何允许用户选择语言/地区的说明，也未声明这是仅面向中文工作流的区域性模板。根据规则，强制特定语言而无用户选择或明确正当说明，属于自然语言政策层面的语言/locale 约束问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is written entirely in Chinese and presents the catalog, task names, and operational descriptions only in that language, with no indication that users may choose another language or locale. That can violate a language/locale policy when a skill effectively requires one language without explicit opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file asserts that the four-book structure is exhaustive and stable, yet later documentation references task IDs outside that declared boundary. This inconsistency undermines trust in the routing and verification model, and may let operators or downstream systems assume complete coverage where gaps or undefined paths actually exist.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The catalog declares its task space as PES0-PES38, but later routes requests to PES41/PES42, which are undefined. In an agent skill, broken or dangling routing targets can cause misclassification, failed guardrail execution, or fallback to uncontrolled behavior when a runtime tries to resolve nonexistent nodes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing instructions in Chinese and does not indicate that the user can choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents the skill requirements starting with a Chinese-only heading and continues throughout in Chinese, effectively imposing a specific language on users. The policy allows locale constraints only when user choice or a clearly justified regional constraint is provided, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script imports and executes a user-supplied Python file via importlib and exec_module, which runs arbitrary top-level code from that file with the current user's privileges. This is dangerous if the predicate file is untrusted, because simply loading it can trigger arbitrary command execution, file access, or network activity; the professional/verification-oriented skill context may make users more likely to trust inputs, increasing practical risk.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and CLI help text are written entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when explicitly justified or when users are offered a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and usage/output text are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/complexity_measure.py:13

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/counterexample_search.py:13

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/invariant_check.py:14