ortho-deal-match

• Outcome: Review
• Latest audit: Sep 4, 2026 · 2:34 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent local matchmaking tool with no network exfiltration, but its CLI access controls are too weak for the contact and business data it manages.

Install only if you are comfortable with a local CLI tool storing business and contact data in its own SQLite/JSONL files. Treat the role and consent controls as operational safeguards, not strong authentication: restrict who can run the scripts, do not use shared workstations for sensitive records, and review blocklist, close, whoami, and reveal behavior before using it with real counterparties.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description claims a complete orthopedic supply-demand matchmaking desk with publishing, automated multi-factor matching, gated contact exchange, and lead import. The supplied code chunk is much narrower: it is a CLI module for registration, pledge confirmation, quota enforcement, role assignment, blocklist handling, audit logging, and some access-scope helpers that appear intended to support other modules. While these implemented controls do align with part of the declared description (real-name registration, anti-harassment pledge, rate limits, blocklist, role permissions, hash-chain audit), the core advertised business capabilities are absent from this code chunk. Therefore the declared description materially overstates what the supplied code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: 声明描述的是一个较完整的骨科供需撮合平台，核心包括发布需求/能力、自动评分撮合、实名登记、线索导入获客等。实际代码块只是其中“联系方式交换/撮合跟进”子模块，确实实现了描述中的一部分关键规则：双方都确认后才可 reveal 联系方式，并包含拒访名单、角色权限、配额检查、审计留痕和后续反馈记录。但从该代码本身看，缺少声明中多个重要的一线能力，尤其是自动五维撮合、发布需求/能力、展会名录导入获客等平台主功能，因此代码行为与完整声明不完全相符。虽然不构成恶意越权，但若按‘声明是否准确代表该代码块实际做什么’来判断，应视为存在描述-行为不匹配：声明范围明显大于该代码块的实际功能，同时代码还包含一个未在描述中突出说明的分派跟进能力。

Ae1

High

• Category: analysis-evasion

Content

$PY scripts/match.py run --all --user U001 --min-score 40 --verbose

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

$PY scripts/match.py run --all --user U001 --min-score 40 --verbose

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

$PY scripts/match.py run --all --user U001 --min-score 40 --verbose

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Blocklist add/remove/list operations have no verified authorization checks despite the skill describing role-based controls. Any caller can read the full blocklist and can modify it by passing an arbitrary --by value, allowing unauthorized censorship, denial of introductions, and disclosure of sensitive business-rejection history.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The CLI defines block/unblock with a default --by value of owner, but the command handlers never verify that the actor is actually an owner. This creates an authorization bypass and audit spoofing issue: callers can perform privileged actions while the audit trail falsely attributes them to 'owner'.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The close command updates demands or capabilities by ID without verifying that the caller owns the record or has an administrative role. Any user who can invoke the script and knows or guesses an ID can deactivate another party's listing, causing unauthorized tampering and denial of service in the matchmaking pipeline.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file explicitly mandates a single branding form, stating that all external releases must use the unified label "注册老炮" and must not include a real personal name, employer, or internal path. In a marketplace skill that handles business matching and imports leads, this reduces user/operator choice and can obscure accountability or provenance, even though it does not by itself create a direct code-execution or data-exfiltration flaw.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises commands that invoke Python scripts, import data, and manipulate local files/databases, yet it declares no explicit tool scope or allowed-tools boundary. In an agent environment, that omission can let the runtime grant broader shell, file, environment, or network capabilities than users expect, increasing the chance of unintended execution, data modification, or exfiltration.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger text includes broad business phrases such as 获客 and 搭接买卖双方, which can match many ordinary sales or sourcing conversations. In an agentic system, overly broad activation increases the risk of unintended invocation of a skill that handles contact data, writes local state, and may reveal or import records, causing privacy or workflow integrity issues.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow explicitly instructs users to reveal and manually pass counterpart contact details once both sides agree, but it does not present a clear privacy warning, data-sharing notice, or consent boundary at the point of disclosure. In a lead-generation and matchmaking context handling real names, emails, and business contacts, this can normalize disclosure of personal/business contact data without adequate user awareness, creating privacy, compliance, and harassment risks if the process is misused or participants do not fully understand what will be shared.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instruction to run `init_db.py --reset` and `demo.py --yes` is presented as a recovery step without an explicit warning that it can destroy or overwrite existing records. In a system that stores audit trails, blocklists, identities, and matchmaking history, an operator could accidentally erase operational or compliance-relevant data, undermining traceability and service integrity.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file presents its purpose, usage instructions, prompts, and user-facing output entirely in Chinese, which constitutes a language/locale constraint in natural-language content. The file does not indicate that Chinese is optional, user-selectable, or justified as a region-specific requirement.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The block and unblock commands overwrite the blocklist file, changing who can appear in matching results, but they do so immediately with no confirmation prompt before the write. Although the code prints status after completion, there is no pre-action confirmation for these potentially impactful data changes.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The whoami command accepts any supplied user ID and prints full registered contact details without authenticating that the caller is that user or an authorized owner. In a matchmaking platform handling real names and personal contact data, this enables trivial enumeration and disclosure of sensitive identity/contact information.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file's docstring and all user-facing prompts are written in Chinese, and the script also explicitly reconfigures stdout to UTF-8 for that output. There is no indication that language selection is optional or justified as a region-specific tool, which can violate language/locale policy requirements.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(args, quiet=True):
    r = subprocess.run([PY] + args, cwd=HERE, capture_output=True, text=True,
                       encoding="utf-8", errors="replace")
    if not quiet:
        print(r.stdout)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and CLI usage text are written entirely in Chinese, and the rest of the script continues to emit Chinese-only user-facing messages. This imposes a specific language/locale on users without offering a choice or documenting that the tool is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring, CLI help text, and all user-facing output are written exclusively in Chinese, which imposes a specific language on users. The file does not offer any opt-in, fallback, or documentation that this skill is intentionally limited to a Chinese-speaking context.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code's module docstring and all CLI usage/help text are written in Chinese, and user-facing print messages throughout the file are also Chinese-only. For a general-purpose publishing skill, this constitutes a language/locale policy issue because the skill does not provide user opt-in or an alternate language path.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The list command returns all demands and capabilities unless the caller explicitly uses --mine, and there is no access-control check before exposing other parties' records. In a B2B matchmaking workflow handling buyer/seller leads, countries, categories, and business activity, this broad enumeration leaks commercially sensitive marketplace intelligence and bypasses the stated controlled-contact model.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This code file contains natural-language documentation that assumes Chinese as the user-facing language, including the title, description, and usage example. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The documentation includes a one-command demo that clears existing data, with only a brief inline note. In practice, users or agents may copy-paste quickstart commands without appreciating that stateful business records, audit data, or registry content will be deleted, leading to integrity loss and accidental destruction of potentially sensitive operational data.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: This manifest contains a natural-language value in Chinese for the author field, but the file provides no indication that non-Chinese language use is optional, user-selectable, or tied to a documented regional context. Under the policy rule for language or locale constraints, a forced or unexplained single-language choice can be a policy concern.

Static analysis

No suspicious patterns detected.