Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
整个技能名称、描述、功能说明和使用指引均以中文固定呈现，未见任何关于可切换语言、按用户偏好响应，或该技能仅限中文场景的说明。按自然语言政策要求，若技能实际上强制特定语言而不给用户选择，可能构成语言/区域策略违规。
- Content
Security audit
📄 全能文档管家
Security checks for vulnerabilities and agentic risk
Overview
This is a document-processing skill with broad but disclosed capabilities and no artifact-backed signs of malicious execution, persistence, or data exfiltration.
Install only if you intend to use a broad document assistant. Avoid submitting confidential contracts, personal data, secrets, or regulated documents unless you are authorized and comfortable with how your agent environment processes files and URLs. The publisher should align the metadata with SKILL.md and add explicit privacy and sensitive-document guidance.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description is very broad ('格式互转、PPT多模板生成、文档摘要、合同分析——文档一条龙'), which can cause overly eager invocation outside a narrowly intended scope. In an agent setting, vague trigger boundaries increase the chance that unrelated user requests containing documents, summaries, or formatting needs will route sensitive content into this skill without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill processes uploaded documents, URLs, and contract text but does not warn users about privacy, confidentiality, or sensitive-data handling risks. This is dangerous because users may submit contracts, internal documents, or personal data without understanding exposure risks, especially when content may be transformed, summarized, or sent through external tooling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The provided manifest context describes a broad 'document pipeline' skill including format conversion, PPT template generation, summarization, and contract analysis, but this file's own description only claims document upload, key information extraction, and summary generation. This is a semantic mismatch in stated behavior that could mislead users about the skill's actual scope.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Saying the skill is for '所有人都用到' weakens constraints on appropriate use and suggests universal applicability. In an orchestration environment, this kind of generalized positioning can bias selection logic or human operators toward using the skill in cases where a more specialized or privacy-preserving path would be safer.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a manifest file, so vague-trigger rules apply. The phrase '上传任意文档' ('upload any document') is very broad and does not specify document types, contexts, or limits, which could cause the skill to be invoked for many everyday document-related requests without clear boundaries.
- Content
Static analysis
No suspicious patterns detected.