evid-four-check

• Outcome: Review
• Latest audit: Oct 16, 2026 · 11:38 PM UTC
• Version: 1.0.2

Overview

The skill appears to be a legal evidence review helper, but its manifest, instructions, and data-handling claims do not line up clearly enough for sensitive evidence use.

Review before installing. The code itself looks like a local CLI, but the skill instructions overstate or mismatch how data is handled, especially around evidence-package paths and automatic audit-log archival. Do not use it with confidential legal evidence unless you first clarify exactly what files are read, what logs are written, where they are retained, and which tool permissions the runtime will actually grant.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

Deterministic JSON IR with `rc` (**0** = completed, no warnings / **1** = completed with warnings, incl. strict presumption / **2** = insufficient or invalid input), `four_properties`, `dimension_basis`, `possible_conclusions`, `conclusion`, `remediation`, `missing_inputs`, `warnings`, `clause_review_checklist`, and `aigc_mark` (GB 45438-2025 metadata; `is_generated: true`, label basis noted as pending verification).

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest declares network: false, filesystem: false, and subprocess: false, yet the skill documentation describes reading evidence packages, loading rule bases, emitting response packages, and archiving logs. This mismatch is dangerous because reviewers, orchestrators, or policy engines may grant trust or route execution based on the manifest while the skill behavior implicitly requires data access and persistence, creating a deceptive security boundary around sensitive legal evidence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains natural-language instructions that effectively enforce a single language context for use of the skill. Under the policy, forcing a specific language without user opt-in or a documented justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description lists trigger words including "合规" and "判定器", which are generic terms that can appear in many unrelated requests. It also says the skill should be used "当需要电子证据四性审查判定器能力时", which does not clearly distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is described as processing evidence datasets and automatically archiving logs, yet it does not clearly warn users about privacy, confidentiality, or retention implications. Because electronic evidence often contains highly sensitive personal or legal material, silent logging or retention can expose protected data, violate policy, and create compliance risk even without overtly malicious behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file presents its primary instructions, disclaimers, CLI help text, and result wording in Chinese, which effectively forces a specific language/locale for users. The policy allows fixed locale behavior only when the constraint is explicitly justified or when users are offered a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · evid-four-check.py (reported line 272)May include surrounding context.

python

# 进程退出码遵循本技能库约定：0＝案例全部执行完毕 / 2＝存在输入错误。
        # 各案例的实际 rc 见 IR 的 rc 字段（可为 0/1/2），--demo 不代替单次调用的 rc 语义。
        sys.exit(0 if allok else 2)
    args = {k: getattr(ns, k) for k in argnames}
    try:
        res, rc = _run(args)
    except GateError as e: