Back to skill

Security audit

tw-mobile-accessibility-consultant

Security checks for vulnerabilities and agentic risk

Overview

This is a Taiwan-focused accessibility audit guidance skill with no executable code, persistence, network retrieval, or hidden privileged behavior.

Install this skill if you want Traditional Chinese guidance for Taiwan mobile accessibility audits. Provide only the screenshots, code, recordings, or test data needed for the audit, and use test accounts rather than real credentials or payment data.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The checklist explicitly instructs writers to use '清楚繁體中文', which imposes a specific language/locale requirement in natural-language guidance. The file does not offer opt-in language choice or explain that the checklist is limited to a Taiwan-specific compliance context, so this appears to violate the language/locale policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The changelog text states the skill is for a Traditional Chinese (Taiwan) mobile app and mobile website accessibility consultant. This is a locale/language constraint expressed in natural language, but the file does not indicate user opt-in or an offered language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Line L46 states '預設使用繁體中文 Markdown', which establishes a specific language/locale behavior. The file does not also state that users may choose another language by preference, so this is a natural-language locale policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown template is entirely written in Traditional Chinese and does not offer any language or locale selection. Under the policy rule for natural-language constraints, a fixed language can be a violation when the skill does not explicitly provide user opt-in or document a justified region-specific scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.