recall-decision-checker

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This skill is a small local recall-level helper with no hidden access, but its regulatory output is very simplified and needs expert review.

Install only if you want a local, Chinese-language preliminary recall-level helper. Treat its results as prompts for expert review, not as recall decisions: verify current official rules, note that use_phase is ignored, and do not rely on the broader lifecycle wording as implemented coverage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The file’s user-facing name, description, instructions, warnings, and examples are all presented in Chinese, and there is no indication that the skill supports other languages or that the Chinese-only presentation is an explicit user opt-in. Under the policy rule for language or locale constraints, this can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring and user-facing descriptions are presented only in Chinese, and the file does not indicate that the user can select another language or that the tool is intentionally restricted to a Chinese-speaking/regulatory context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill advertises broader medical-device lifecycle decision support, but the implementation only maps a single harm input to canned recall levels and obligations. In a medical/regulatory context, this mismatch can cause operators to overtrust incomplete output and make non-compliant or unsafe recall decisions based on missing factors.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: Line L19 states that the documentation is in Chinese ("中文文档见 `SKILL.md`") with no indication of an alternative language option or user opt-in. This can constitute a language/locale policy issue because it prescribes a specific language for core skill documentation rather than offering a choice.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The code defines and documents use_phase as an input but completely ignores it during classification, creating a silent logic gap between user expectations and actual decision behavior. In this medical recall setting, ignored decision factors can lead to incorrect urgency, notification, or containment actions while appearing authoritative.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

allok = False
                print(json.dumps({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2}, ensure_ascii=False))
        sys.exit(0 if allok else 2)
    args = {k: getattr(ns, k) for k in argnames}
    if not any(v not in (None, "") for v in args.values()):
        # 无参数时打印帮助
        p.print_help()

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.