Security audit

Labor Arbitration

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed China labor-arbitration helper that processes sensitive case details locally and needs privacy caution, but I found no hidden execution, persistence, or exfiltration.

Before installing, be prepared for the skill to handle highly sensitive labor, wage, address, phone, and ID information. Use only official government platforms, avoid sharing more documents than necessary, store generated files in a controlled folder, and verify current law or deadlines with 12333, 12348, the local arbitration commission, or a qualified lawyer.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 该描述与代码存在明显能力范围不一致。代码的主要用途是自动生成劳动仲裁申请相关文书，并对有限类型的请求金额进行计算，这与声明中的“一键生成仲裁申请文档”部分相符，也部分涉及“资料整理清单”。但声明强调的是劳动仲裁“全流程辅助”，包括资料研判、线上提交步骤指引、调解谈判策略、全国地区覆盖等，这些在代码中均未体现。代码没有网络访问、没有面向各地仲裁平台的提交流程实现、没有分析证据充分性的逻辑，也没有任何谈判策略模块。因此，虽然代码属于该技能描述中的一个子功能，但不足以支撑所宣称的完整能力集合，构成描述与实际行为的实质性不匹配。

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The natural-language content of the skill is presented exclusively in Chinese, including usage instructions and disclaimer text, with no indication that users may choose another language. Under the policy, a skill should not force a specific language or locale without explicit opt-in or documented justification.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill instructs the agent to read multiple reference files and generate output documents via a script, but it declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where a host agent may grant broader file read/write access than the skill actually needs, increasing the risk of unintended filesystem access if invoked in a permissive environment.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is broad enough to match common labor-law discussions, which can cause the skill to activate unexpectedly in conversations that only tangentially mention employment disputes. In context, unexpected activation is more dangerous because the skill requests sensitive personal and employment data and may initiate document-generation workflows, leading to unnecessary collection or processing of private information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide explicitly tells users to input and upload highly sensitive personal information, including身份证号,住址,电话 and identity documents, but provides no warning about privacy risks, data minimization, secure device/network use, or official-platform verification. In a labor-arbitration skill, users are often vulnerable individuals under stress, which increases the likelihood they will overshare or submit documents through spoofed or insecure channels if not cautioned.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: This markdown file contains user-facing natural language content only in Chinese, beginning with the title and continuing throughout the checklist. Under the language/locale policy, forcing a specific language without offering user choice or documenting a justified regional constraint can be a policy violation.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: This markdown file consists wholly of Chinese-language instructions and does not indicate that the user can choose another language. Under the natural-language policy rules, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.