Security audit

method-structure-diagnostic

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only academic writing diagnostic skill with bundled reference materials and no evidence of unsafe system access or hidden behavior.

Installers should expect this skill to produce Chinese Method-section diagnostic reports. Reviewers may want the publisher to make the template language-adaptive and fix the stale reference paths, but I found no security reason to block it.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill metadata and description constrain interaction to Chinese without indicating that the user may choose another language. This can degrade usability, cause misunderstanding of safety-critical guidance, and create accessibility/fairness issues for users who cannot reliably read Chinese.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The fixed output template mandates Chinese headings, labels, and report structure with no opt-in or multilingual alternative. If followed literally, the agent may ignore the user's language preference and return evaluations the user cannot understand, including potentially important diagnostic limitations or remediation guidance.

Static analysis

No suspicious patterns detected.