Security audit

traffic-law

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed local traffic-law document parsing and output generation, with no evidence of hidden network access, persistence, credential use, or destructive behavior.

Install only if you need a local Chinese traffic-law document parser or exam-answer template helper. Review input and output paths before running it, because it can copy document text into JSON, markdown, or .txt files; do not expect it to generate finished legal or exam answers without human review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description overstates the implemented functionality. The script does partially align with exam-paper handling: it can extract text from a .docx file and create an output document related to traffic law exams. However, its primary implemented behavior is limited to single-file parsing and template generation. It does not perform batch processing, does not parse arbitrary legal documents into a structured knowledge base, and does not produce substantive exam answers from the exam content. The optional JSON loading is minimal and not used to synthesize detailed answers. Therefore the description does not accurately represent the actual code behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code substantially matches the legal-document extraction portion of the description: it reads Word files from a default E:\jiaotong legal-documents path, extracts .docx text, derives article snippets, and saves structured JSON. However, the declared purpose also includes parsing traffic safety exam papers and generating exam answers based on traffic laws, which are not present anywhere in the supplied code. Additionally, while the description suggests extracting text from Word documents generally, actual .doc support is not implemented beyond a placeholder string. Because key advertised capabilities are absent and the implemented behavior is narrower than the declared primary purpose, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes file read/write behavior but does not declare any explicit tool scope or permissions boundary. That increases the chance the agent invokes filesystem capabilities more broadly than users expect, especially when handling legal documents and producing output files containing potentially sensitive content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill description states that it generates answers based on Chinese traffic safety laws, and the manifest/usage text consistently assumes a Chinese legal and language context. There is no explicit user opt-in, choice of jurisdiction, or clear statement that the skill is only for China-specific workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The activation conditions are broad enough to trigger on ordinary document-processing requests, which can cause the skill to handle files or generate outputs in contexts the user did not specifically intend. In a skill that reads legal documents and writes parsed content, overbroad triggering increases the risk of unnecessary access to sensitive files and surprise actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs saving parsed document contents to output files without warning that full document text may be copied into new artifacts. For legal and accident-related materials, that can duplicate sensitive personal or case information and leave it in locations the user did not anticipate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring states it 'generates complete answers' based on traffic laws, and the CLI description repeats that claim. In practice, the code parses .docx text, saves raw content, and emits a markdown template whose own content says complete answers still need to be filled in manually or via separate AI analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This Python file contains natural-language text that fixes the skill's legal/regulatory basis to China-specific laws. Under the policy rule, forcing a specific locale without user opt-in or an explicit documented justification is a reportable natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file description and extraction logic are explicitly limited to Chinese legal documents, including a Chinese-only article regex later in the code, but there is no user opt-in or documented rationale that this is intentionally region-specific. Under the policy, forcing a specific language/locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill explicitly generates complete answers for exam papers, but the description does not disclose any caution about academic integrity, misuse, or the need for user review. For a markdown skill description, this is a missing user-facing warning about a behavior that may have policy or misuse implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The function name and docstring describe 'Generate complete quote from exam file,' which does not match the implemented steps. The body parses the exam paper, saves raw extracted text, and generates a template document rather than any quote-oriented output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.