Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
- Suspicious Unicode normalization or mixed-script content
Security audit
Magnetic Circuit Calculator
Security checks for vulnerabilities and agentic risk
Overview
This is a visible Chinese-language motor magnetic-circuit calculator with local scripts and reference tables, and I found no hidden data access, network behavior, persistence, or privilege-seeking behavior.
Install only if you are comfortable with Chinese-language engineering tools and approximate magnetic-circuit estimates. Verify numerical results independently before using them for real motor design decisions, especially because the enhanced script contains calculation reliability issues, but the package does not show security-sensitive behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Natural-Language Policy Violations
Medium
- Confidence
- 90% confidence
- Finding
- The manifest description and the entire markdown content are written in Chinese, with no indication that users may request another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
- Suspicious Unicode normalization or mixed-script content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
- Suspicious Unicode normalization or mixed-script content
Intent-Code Divergence
Medium
- Confidence
- 94% confidence
- Finding
- L125注明“Nph（需根据实际填入）”，给人的意图是该值只是待用户补充显示项；但实际在L65-L67中代码已用硬编码的每槽导体数和并联支路数计算Nph，并在L73和L76中直接用于Ke、Kt估算。这会让文档描述与真实计算依据相矛盾，掩盖性能结果依赖固定假设而非用户实际输入。
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
- Suspicious Unicode normalization or mixed-script content
Natural-Language Policy Violations
Medium
- Confidence
- 94% confidence
- Finding
- This Python file contains natural-language usage instructions exclusively in Chinese, and the same language choice continues throughout user-facing output. Under the policy, forcing a language or locale without opt-in is a violation unless the constraint is explicitly documented and justified.
Natural-Language Policy Violations
Low
- Confidence
- 93% confidence
- Finding
- This markdown skill reference forces a specific language for all instructions and reference data, which can violate a language/locale policy when no user opt-in or justification is provided. The document contains no indication that Chinese is optional, selectable, or required for a region-specific purpose.
Natural-Language Policy Violations
Low
- Confidence
- 92% confidence
- Finding
- This code file contains user-facing natural-language descriptions entirely in Chinese, including the title and usage text, with no indication that the skill is region-specific or that other languages are supported. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Intent-Code Divergence
Low
- Confidence
- 82% confidence
- Finding
- The function documentation describes temperature-corrected magnetic properties as part of the magnetic-circuit calculation, and the module defines per-material temperature coefficients in `PM_MATERIALS`. However, the implementation uses a fixed `alpha = -0.0008` regardless of the chosen magnet grade, which contradicts the documented/material-specific intent rather than merely omitting detail.
Static analysis
No suspicious patterns detected.