evidence-chain-check

• Outcome: Review
• Latest audit: Oct 16, 2026 · 11:39 PM UTC
• Version: 1.0.4

Overview

This skill appears non-malicious, but its legal evidence-chain validation is materially weaker and less accurately scoped than its compliance-oriented claims suggest.

Review this carefully before relying on it for legal, audit, or compliance decisions. It may be useful as a lightweight consistency checker for known-good structured data, but it should not be treated as tamper-proof evidence validation unless the hash/schema validation is strengthened and the permissions and CLI documentation are corrected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evidence_chain_check.py:11

Finding

Evidence integrity validation can be bypassed with incomplete or self-consistent metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/evidence_chain_check.py, lines 11–27
Vulnerability Type: Insufficient cryptographic and schema validation
Risk Level: High

Vulnerable Code

python

for i, e in enumerate(chain):
    subj = e.get("subject")
    if subj: subjects.add(subj)
    t = e.get("time")
    if last_t is not None and t is not None and t < last_t:
        breaks.append("时间倒序 @" + str(i))
    last_t = t
    h = e.get("hash")
    if prev_hash is not None and e.get("prev") != prev_hash:
        breaks.append("哈希链断裂 @" + str(i))
    prev_hash = h
if len(subjects) > 1:
    breaks.append("主体不一致:" + "/".join(sorted(subjects)))
return {"breaks": breaks, "complete": len(breaks) == 0, "subjects": sorted(subjects)}

Technical Analysis

The checker trusts integrity metadata supplied inside the evidence JSON. It only compares each record's prev value with the preceding record's declared hash; it never cryptographically recomputes a record digest from the evidence content.

Mandatory fields are also not enforced:

• A missing subject is silently ignored.
• Missing timestamps do not cause rejection.
• Missing hashes can prevent link validation because the comparison runs only when prev_hash is not None.
• An empty chain produces no break conditions and is therefore reported as complete.
• Arbitrary modified records pass when their attacker-supplied hash and prev values remain mutually consistent.

Consequently, structural consistency of untrusted metadata is treated as proof of evidence integrity. This crosses the trust boundary between an untrusted evidence source and the compliance decision consumed by an auditor or automated gate.

Attack Path

1. An attacker supplies or modifies an evidence-chain JSON value before it is checked.
2. The attacker removes integrity fields or changes evidence content.
3. The attacker either omits hash and prev values or assigns arbitrary values that remain internally consistent ...[truncated 984 chars]

Remediation

View remediation

Remediation Suggestions

1. Define and enforce a strict schema for every evidence record.
2. Reject empty chains and records missing required fields such as id, time, subject, hash, and prev.
3. Validate field types and accepted timestamp formats before comparing values.
4. Define a deterministic canonical serialization for the fields protected by each hash.
5. Cryptographically recompute every record's digest from its canonical content and compare it with the declared hash.
6. Verify each prev value against the independently recomputed digest of the preceding record.
7. Define and validate an explicit genesis-link rule for the first record.
8. Restrict hashing to approved algorithms and include an algorithm identifier in the validated schema.
9. If authenticity is claimed, verify digital signatures against explicitly trusted keys rather than trusting signature fields in the input.
10. Add negative tests for empty arrays, missing fields, altered content with unchanged hashes, fabricated self-consistent links, mixed subjects, invalid timestamps, and malformed record types.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The license and attribution section is primarily written in Chinese and presents mandatory-looking compliance text such as “务必并读” and “整体复制、未删改,” without offering an English equivalent for users who may not read Chinese. This creates a language/locale policy concern because the skill otherwise includes bilingual material, but this operational/legal section effectively defaults to a single language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest declares filesystem: false and subprocess: false, yet the skill’s documented workflow requires passing --input <path> to a Python CLI and executing python evidence_chain_check.py. This mismatch can cause policy engines, reviewers, or agents to misclassify the skill’s real capabilities, undermining trust boundaries and potentially allowing file access or execution behavior that was not accurately disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The changelog states a mandatory bilingual rewrite, and the file consistently presents the skill in Chinese and English without indicating that users may choose another language or locale. Under the stated policy, forcing a specific language set without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing descriptions are written exclusively in Chinese, and the script's CLI help and output messages also assume Chinese as the only locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.