Security audit

HouseBuying-CN 国内买房全流程助手

Security checks for vulnerabilities and agentic risk

Overview

This house-buying skill is mostly coherent, but it includes under-scoped legal and financial guidance that could mislead users in real property transactions.

Review carefully before installing. Treat this as informational guidance for mainland China housing workflows, not legal, tax, lending, hukou, or school-district advice. Verify all rates and eligibility with current local authorities, banks, agents, or a lawyer, and do not rely on the suggestion to change declared transaction prices for tax or loan advantages.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code is related to the real-estate domain, but its actual functionality is much narrower than the declared description. It performs mortgage calculations, affordability estimates, and tax/fee calculations via CLI commands. It does not contain logic for contract审查, 过户流程 guidance, 看房检查清单, 选房建议, 落户分析, or 学区分析, all of which are explicitly claimed in the description. There is no evidence of undeclared sensitive behavior or resource access, but the declared purpose materially overstates the implemented capabilities, so this should be flagged as a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The content explicitly recommends adjusting the reported 网签价 to lower taxes or obtain more loan proceeds, but does not clearly state that misreporting transaction prices can constitute tax evasion, mortgage fraud, or other regulatory violations. In a house-buying assistant, this is especially dangerous because users may treat the guidance as practical, compliant advice and act on it in real transactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list uses very broad everyday phrases such as '买房', '选房', '签合同', and '过户', which can cause the skill to activate in contexts where the user did not intend to request this specific advisory workflow. Unintended invocation can surface stale or incomplete financial/legal guidance at the wrong time, increasing the risk of user reliance on misapplied advice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill presents tax, loan, contract, hukou, and school-district guidance without a prominent warning that rules vary by city, time, lender, and case facts. In this domain, users may act on outputs as if they were definitive legal or financial advice, leading to costly mistakes such as incorrect tax expectations, loan planning errors, or contract risk acceptance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s docstring presents usage exclusively in Chinese, and the command vocabulary shown to users uses Chinese-only trigger words such as “月供”, “贷款”, “总价”, and “税费”. This creates a language/locale constraint without any opt-in, fallback, or documented justification, which matches the policy’s language-choice concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code states '满5唯一住房，免征个税' but only checks years_owned >= 5 and has no input or logic for the '唯一住房' condition. In a house-buying skill, this can systematically understate transaction taxes and mislead users making real financial decisions, even though it is not a code-execution issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The user-facing help text and command dispatcher require Chinese command names at runtime, including “贷款”, “月供”, “家庭”, and “税费”, with no alternative locale support. Because this restriction is hard-coded and not presented as an explicit user choice or justified regional requirement, it constitutes a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is explicitly framed as a "国内买房" assistant and all user-facing content is presented only in Chinese, which imposes a specific language/locale context without offering an alternative or opt-in. Under the language/locale policy, this can be a natural-language policy issue unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains end-user instructional content exclusively in Chinese, with no indication that the skill is intentionally region-specific or that users can select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all user-facing guidance exclusively in Chinese, beginning with the title at L001 and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no justification or language choice is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.