Security audit

super-calculator

Security checks for vulnerabilities and agentic risk

Overview

This is a local calculator skill with some overbroad marketing and routing language, but no evidence of hidden, destructive, persistent, or data-exfiltrating behavior.

Install only if you want a Chinese/bilingual local calculator assistant. Treat finance, exchange-rate, BMI, BMR, and calorie outputs as estimates and verify important financial or health decisions with authoritative sources. Ambiguous requests should be clarified before the skill calculates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description and code are broadly aligned around a multifunction calculator skill, especially for finance, statistics, units, dates, BMI, and equation solving. However, there are material discrepancies. The code includes an undeclared capability: BMR/basal metabolic rate and daily calorie estimates. More importantly, several specifically declared capabilities are not actually present in this code chunk: generic arithmetic/four-operation calculation, percentage calculation, and exchange-rate conversion. The existing unit conversion table covers length, weight, area, and temperature, but not currencies. Because the declared description promises a very broad '万能计算助手' with specific examples that are missing here, and the code also adds an undeclared health-related calculator, this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are overly broad and include common everyday expressions such as '计算', '多少钱', and similar wording, which can cause accidental invocation outside the intended context. Over-triggering can route unrelated user requests into this skill, producing incorrect outputs, bypassing more appropriate skills, or causing the agent to handle sensitive financial/health/date queries without adequate confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The '直接触发' list uses vague terms and a catch-all phrase equivalent to 'any calculation-related expression,' leaving no clear boundary for activation. In an agent setting, this increases the chance of unintended skill selection and can be exploited indirectly by phrasing unrelated prompts with generic calculation language to steer routing behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README markets the skill as being triggerable by a very broad class of phrases such as 'one sentence' and 'calculate anything,' which can cause the agent to invoke it in situations the user did not clearly intend. In an agent environment, overbroad routing can lead to incorrect tool selection, unexpected handling of sensitive numeric data, or misleading outputs in contexts like finance or health where precision and scope matter.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language trigger guidance is underspecified because it says users can simply describe a need and the AI will automatically recognize and call the skill, without defining disambiguation rules or exclusions. This increases the chance of accidental invocation from conversational text containing numbers, dates, money, or measurements, potentially producing authoritative-sounding but contextually wrong results.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: L02-L03 以中文名称和中文描述定义技能，但未说明是否支持按用户偏好切换语言或是否仅限中文场景。按规则，若技能在语言上形成默认强制约束且没有用户选择或明确、合理的地区限定，可能构成自然语言策略问题。
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural language exclusively in Chinese in the module docstring and throughout returned messages. Because the skill does not offer language selection or document that it is intentionally limited to a Chinese-speaking context, it can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill advertises health-related outputs such as BMI, BMR, and daily calorie needs, but the README does not prominently warn that these are informational estimates and not medical advice. Users may over-trust the results for health decisions, especially because the skill emphasizes precise results and complete calculation steps.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all content in Chinese from the title onward, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.