ortho-expo-contacts

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 3:31 AM UTC
• Version: 1.1.0

Overview

This skill is a local contact-directory lookup tool with disclosed safeguards and no evidence of hidden data export or unsafe automatic behavior.

Install only if you are authorized to process the expo and contact data you place in the source directory. Keep data/contacts.db, registry/, and audit/ out of shared storage and published packages. Use --include-l3 only for your own private contact lists, and remember that rebuilding the index replaces the local contacts.db index.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A second material mismatch exists between the promised product capabilities and the actual behavior: the skill claims broad expo-directory coverage and concrete query features, but the analyzed implementation reportedly does not provide the advertised contact lookup and filtering workflows. In the context of a tool handling personal and business contact records, overstating safeguards and functional boundaries can lead operators to ingest and use regulated or sensitive data under false assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A second material mismatch exists between the promised product capabilities and the actual behavior: the skill claims broad expo-directory coverage and concrete query features, but the analyzed implementation reportedly does not provide the advertised contact lookup and filtering workflows. In the context of a tool handling personal and business contact records, overstating safeguards and functional boundaries can lead operators to ingest and use regulated or sensitive data under false assumptions.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The statement "品牌署名统一用「注册老炮」" and "不得出现个人真名、在职公司或内部路径" imposes a fixed naming/locale convention in natural language. Under the policy, forcing a specific language or locale form without offering user choice or documenting a justified regional constraint is a natural-language policy concern.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill describes scripts that read environment configuration, read source files, and write local databases/registry/audit artifacts, but it does not declare an explicit tool scope or permissions boundary. That makes the effective data access and modification surface ambiguous, which increases the chance of over-privileged execution and weakens review of how sensitive contact data is handled.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says the skill should be used when the user wants to '查骨科展会联系方式、找某国参展商、找某类产品供应商、查 OMTEC 参会人、整理展会名录', which mixes specific and broad intents such as '整理展会名录'. In a manifest/markdown context, this lacks explicit trigger constraints or negative examples, increasing the chance of unintended activation for general contact-list or directory-organizing requests.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The documentation reassures users that source Excel files are read-only and never modified, but elsewhere permits importing L3 private customer/supplier contacts into the searchable index. Even if the source files themselves stay unchanged, this framing can understate that sensitive private contact data may still be copied into a local database, expanding exposure and retention risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: 该 Markdown 文件全文以中文编写，未说明这是面向特定中文用户群的区域性/语言性技能文档，也未提供其他语言选项或用户选择机制。按照语言/locale 政策，若技能强制单一语言而没有用户 opt-in，属于自然语言层面的潜在政策违例。

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module docstring, CLI help text, and runtime messages are written in Chinese only, which imposes a specific language on users. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which is present here.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script rebuilds a local SQLite database that can contain L2/L3 personal contact data, and the schema unconditionally drops existing tables before recreating them. In this skill context, the dataset includes attendee names, work emails, and optionally private phone/WhatsApp data, so an undisclosed destructive rebuild increases risk of accidental data loss and weakens safe handling expectations around sensitive records.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file presents its purpose, usage instructions, prompts, and outputs exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: 该文件全文以中文撰写，未见任何为用户提供语言/locale 选择、双语说明，或声明该技能仅面向特定中文使用场景的自然语言说明。根据规则，若技能材料强制特定语言而无用户 opt-in 或明确、合理的区域性约束，属于自然语言层面的语言/locale 政策风险。

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The skill display name and primary documentation are presented in Chinese, while the policy-relevant concern is that no user-facing language choice is stated for invocation or interaction. For multilingual environments, forcing one language without opt-in can conflict with locale-choice expectations unless the limitation is explicitly documented as required.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This manifest contains a natural-language value in Chinese for the author field, which introduces a locale-specific element without any accompanying opt-in, choice, or documented regional justification in the file. Under the policy rule for language/locale constraints, fixed locale-specific language can be a violation when no user choice or justification is provided.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The module docstring emphasizes a read-only, non-modifying posture, which suggests a non-destructive tool. However, the main build path drops existing SQLite tables via the schema script and rewrites the local index database, so the tool does perform destructive local writes even if it leaves source Excel files unchanged.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The module docstring, usage instructions, parameter descriptions, and user-facing output are presented in Chinese only. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue when no alternative or choice is provided.

Static analysis

No suspicious patterns detected.