data-grade-checker

• Outcome: Review
• Latest audit: Oct 17, 2026 · 1:10 AM UTC
• Version: 1.0.3

Overview

The skill appears to be a local data-classification helper, but its manifest grants broad file, shell, write, and web tools while also claiming those permissions are disabled.

Review before installing. The code itself looks local and simple, but the package metadata grants more agent authority than the tool appears to need. Use it only in an environment where broad file, shell, write, and web access are acceptable, and redact real personal, business, or regulated data unless the runtime is approved for that data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest declares permissions.network=false, permissions.filesystem=false, and permissions.subprocess=false, but simultaneously grants WebFetch, Read/Glob/Grep/Write, and Bash. This is a direct policy contradiction that can defeat sandboxing expectations and cause downstream systems or reviewers to incorrectly treat the skill as non-interactive and low risk when it actually has network, file, and command-execution capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This file contains natural-language operational guidance only in Chinese, including instructions the AI agent is expected to follow. Under the policy, forcing a specific language without user opt-in or documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text explicitly states that the documentation is in Chinese (中文文档见 SKILL.md) and the README overall presents the skill primarily in Chinese terminology without offering an alternative language option. This can violate a language/locale policy when users are not given a choice or opt-in for the required language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is described as a zero-dependency, internal rule-based classifier that does not need external script or file loading, yet the manifest advertises powerful tools including file access, shell execution, and web fetching. This mismatch can mislead reviewers and users about the true execution surface, increasing the risk that the skill is invoked with more privilege than necessary or later extended to use those capabilities without scrutiny.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger terms include broad, generic words such as '合规' and '判定器', which can cause accidental or overly frequent invocation outside the intended TH-DAT-001 context. Unintended activation is especially risky here because the skill is positioned to process data samples and may expose sensitive business or personal information to a tool the user did not mean to invoke.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation tells users no external script or file loading is needed and implies an internal-only rule engine, while the manifest exposes external-facing tools and execution features. In a security/compliance skill that may receive sensitive data samples, this inconsistency is dangerous because users may trust it with regulated content under false assumptions about where the data can flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly invites users to submit data samples for analysis but provides no warning, minimization guidance, or redaction requirement for potentially sensitive content. Because this is a data classification/compliance tool, users are likely to supply exactly the kinds of confidential or regulated data that require careful handling, making omission of privacy and security guidance particularly dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and user-facing descriptions are entirely in Chinese, and the CLI help/messages throughout the file assume Chinese as the required language. The policy only permits such locale constraints when the skill offers language choice or clearly documents and justifies the restriction as region-specific; that justification is not stated in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The changelog explicitly states "Bilingual rewrite (full EN+ZH, English first)," which imposes a language/locale presentation choice in the skill documentation. There is no indication that users can choose their preferred language or that the English-first ordering is required for a documented regional or compliance reason.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · data-grade-checker.py (reported line 110)May include surrounding context.

python

out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
        print(json.dumps(out_list, ensure_ascii=False, indent=2))
        sys.exit(0 if allok else 2)
    args = {k: getattr(ns, k) for k in argnames}
    try:
        res, rc = _run(args)
    except GateError as e:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content of this index is entirely in Chinese, including the instruction that AI agents should prioritize reading SKILL.md. Under the stated policy, language constraints should either offer user choice or clearly justify the locale restriction; this file does neither.

Content

No source excerpt is available for this finding.