Security audit

RAG Grounding Guard（RAG 事实溯源校验）

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can falsely approve unsupported claims and does not enforce its promised file-access limits.

Use only with explicitly approved, non-sensitive inputs inside a filesystem sandbox. Treat its coverage score as a rough word-matching aid and independently verify facts and citations; do not use it as an automatic release or safety gate. The clean static scan does not resolve the demonstrated logic and containment problems. Scanner coverage gaps were investigated; enforcement of file-access boundaries in your actual host remains unverified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill promises project-scoped access and factual grounding with traceable citations, but the supplied implementation neither enforces that filesystem boundary nor verifies factual support or provenance. This mismatch can expose out-of-scope file contents and give unsupported or contradictory answers a misleading verification result, particularly dangerous in the advertised high-risk decision scenarios.
Content: No source excerpt is available for this finding.

Standalone everyday keywords can activate the skill without a RAG-verification request.

Medium

Category: Trigger Abuse
Confidence: 97% confidence
Finding: The activation condition explicitly includes inputs containing words such as "fabricated" or "nonsense" as an alternative to questioning a RAG answer. These words also occur in unrelated conversations, and this condition does not require retrieval context or a request to verify factual support. The same broad condition appears in Chinese at L103.
Content: No source excerpt is available for this finding.

Input file loading is not restricted to the declared project directory.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The loader accepts absolute paths, parent-directory traversal, and symlinks without checking containment in the declared project directory. If an untrusted argument reaches this function and the process has access, an out-of-scope text file supplied as claims can have its contents printed into the report; actual exposure depends on runtime filesystem enforcement.
Content: No source excerpt is available for this finding.

Claims with no extracted evidence tokens are reported as supported.

Medium

Category: Excessive Agency
Confidence: 100% confidence
Finding: When token extraction returns an empty set, the checker unconditionally adds the claim to the supported list without examining any evidence. An attacker can exploit unsupported scripts or short-token phrasing to inflate grounding coverage and bypass a downstream gate that trusts this report.
Content: No source excerpt is available for this finding.