AI Governance Audit Chain（AI 留痕与门禁）

• Outcome: Review
• Latest audit: Nov 6, 2026 · 12:29 PM UTC
• Version: 1.1.6

Overview

This skill needs review because its approval safeguards and audit checks provide less protection than advertised, while logs and report generation introduce privacy and overwrite risks.

Use this as a manual audit aid; retain independent approval controls for sending, deletion, payments, and publishing. Test with disposable files and mocked recipients. Choose a narrow project directory, exclude file symlinks, and validate report destinations to prevent overwrites. Review and redact logs before committing or sharing them. Do not treat a successful verification or the bundled attestation as proof that every action was recorded or approved; actual enforcement depends on your host agent and approval process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill promises mandatory pre-action approval and per-step accountability, but its documented workflow relies on voluntary recording rather than an enforced execution boundary. This can cause users to entrust dangerous actions to controls that do not actually stop them; the explicit disclaimer about local-log tampering narrows the integrity claim but does not resolve the approval-enforcement mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/02-门禁清单.md (reported line 14)May include surrounding context.

md

|---|---|---|
| 对外发送 | 发邮件、发消息、发帖、提交表单、提交 PR | 发出前把**全文**展示给人工看，确认后才发 |
| 公开发布 | 上传文件、发布站点、上架内容、对外分享链接 | 敏感扫描 0 命中 + 人工点头 |
| 删除 / 覆盖 | `rm`、`git reset --hard`、覆盖同名文件 | 先出 dry-run 清单（列出将被删/被覆盖的每一项），人工确认 |
| 付款 / 下单 / 签约 | 任何产生资金动作 | 双人确认 |
| 改权限 / 改账号 | 提权、加管理员、改访问范围 | 变更单 + 回滚方案 + 事后复核 |

The advertised high-risk action gate records a request but does not enforce approval.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The gate command writes a pending record and returns success without preventing the requested action or authenticating an approval. A workflow that treats successful command completion as permission can continue with an unapproved send, deletion, or payment; a later verification warning cannot undo that action.

Content

No source excerpt is available for this finding.

The recomputation command sorts file hashes rather than following the documented path order, weakening the claimed integrity evidence.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The command hashes a sorted collection of content hashes rather than binding each file's path to its content. Renaming files or swapping their contents can therefore preserve the aggregate fingerprint, undermining the package-integrity claim without requiring a SHA-256 collision.

Content

No source excerpt is available for this finding.

The self-test instructs the agent to perform real operations without warning about their effects on user data or external recipients.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The self-test calls for real file changes, email, and batch operations using an init-to-action sequence without explicitly requiring a sandbox or pre-action approval. Although the surrounding document prohibits unapproved sending, this test recipe can still encourage unintended external messages or changes to live user data.

Content

No source excerpt is available for this finding.

The instruction to commit governance logs omits a privacy warning and incorrectly assures users that the logs contain no sensitive information.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

The instruction to commit governance logs asserts that they contain no sensitive information, despite fields for identities, task descriptions, recipients, paths, and free-text details. Committing these records can disclose personal or confidential business information to repository readers and retain it in version history.

Content

No source excerpt is available for this finding.

Verification can declare the evidence trail valid despite unrecorded file additions.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Verification calculates added files but excludes them from the L2 failure condition, allowing a successful verdict and exit code despite unrecorded additions. An added executable, configuration file, or other behavior-changing artifact can consequently pass a check advertised as detecting unrecorded changes.

Content

No source excerpt is available for this finding.

Report generation contradicts the documented governance-directory-only, append-only output policy.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The report path accepts absolute paths and parent-directory traversal, and opening it with write mode silently truncates an existing file. If an agent accepts an untrusted report destination, this permits overwriting files outside the project with its filesystem privileges, contrary to the documented output boundary and overwrite-approval policy.

Content

No source excerpt is available for this finding.