Security audit

token-disclosure-check

Security checks for vulnerabilities and agentic risk

Overview

The skill's checker script is simple and purpose-aligned, but its metadata grants broad agent tools that do not fit the stated no-network/no-filesystem/no-subprocess permissions.

Review before installing. The packaged code appears non-destructive and limited to local text checking, but the skill metadata should be narrowed or clarified so it does not authorize Write, WebFetch, or broad Bash use beyond the local checker. Treat the results as a compliance pre-screen only, especially because the checker relies on simple Chinese keyword matching.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill declares permissions as network/filesystem/subprocess = false, but elsewhere authorizes WebFetch, Write, Bash, and mentions API/local execution. This is a high-risk policy inconsistency because enforcement systems or human approvers may rely on the restrictive permission block while the operational instructions encourage broader capabilities, enabling unintended file access, command execution, or network use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is written entirely in Chinese and does not indicate that the agent may choose or adapt language based on user preference. Under the policy for natural-language violations, forcing a specific language without opt-in is in scope unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest markets the skill as 'zero-dependency' while simultaneously declaring powerful agent tools such as Bash, Write, Read, and WebFetch, and the risk rationale references API calls and local execution. This discrepancy can mislead reviewers, operators, or automated policy systems into underestimating the skill's actual capabilities and trust boundary, increasing the chance of unsafe approval or deployment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation guidance says the skill should be used 'when token disclosure checker capability is needed,' which does not clearly bound when the skill should or should not activate. Although a specific trigger word is also provided, the broad natural-language condition can still overlap with many general compliance or review requests and lacks negative examples or scope constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The phrase 'When the user needs token disclosure review' is broad and does not define boundaries for activation versus non-activation. It provides no explicit trigger list, exclusions, or negative examples, so the skill could be invoked for loosely related blockchain or compliance tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The statement '当用户需要代币信息披露检查器相关能力时' is circular and ambiguous because it defines use in terms of the skill itself rather than concrete task boundaries. Without exclusions or precise qualifying conditions, it can match a wide range of ordinary blockchain-review requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill embeds Chinese-only required terms, prohibited phrases, and CLI help text, which effectively forces a specific language/locale for use. The policy allows locale constraints only when clearly documented and justified or when the user is given a choice, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The document is explicitly written in Chinese and English and presents the skill in those languages only, with no indication that users may choose another language or that this locale restriction is required for a region-specific deployment. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The user-facing natural language in this index file is entirely Chinese, including the description and file annotations, with no indication that other languages are supported or that the locale constraint is intentional and justified. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.