Security audit

policy-to-action

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it needs review because it can auto-trigger broad policy/tax workflows and includes concrete tax-planning advice without clear compliance safeguards.

Install only if you want a Chinese-language policy report generator and are comfortable with it using web research plus business or personal profile details. Treat its tax outputs as draft informational material, not professional advice, and have any invoicing, entity-structure, filing, or deduction strategy reviewed by a qualified tax professional before acting. Prefer explicit invocation rather than relying on automatic triggers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The action guidance explicitly encourages controlling invoicing pace to stay under VAT exemption thresholds, presented as 'highly operable' and for immediate execution, without any warning about anti-avoidance, sham transaction, or improper invoice timing risks. In this skill context, that makes the content more dangerous because it translates policy directly into operational steps that a business may implement as compliance advice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation is entirely in Chinese and presents the workflow and invocation only in Chinese, with no indication that users may choose another language or locale. This can constitute a language/locale policy violation when no opt-in or explicit regional limitation is documented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example invocation is broad and conversational enough that it could be triggered during ordinary discussion about policy interpretation rather than through an explicit opt-in command. In an agent setting, that increases the chance of unintended activation and accidental processing of user-provided personal or business details.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger regex/phrase list is broad enough to match common conversational requests, increasing the chance this skill activates in contexts where the user did not explicitly request it. Unintended activation can cause unnecessary web access, collection of extra subject details, and generation of authoritative-seeming policy advice when another skill or a general response would have been more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill states it auto-activates whenever any listed keyword is mentioned, without scope limits or disambiguation. In an agent environment, that behavior can hijack ordinary conversations, trigger unintended workflow steps, and prompt for potentially sensitive enterprise or personal profile data before the user has clearly consented to this specific analysis flow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: At L103 the skill says Chapter 6 should use a '纯 CSS 横向时间轴，5 个节点', but at L138-L145 it explicitly requires a '纵向时间线' and forbids horizontal flex. This is an active contradiction in the skill's own documentation about what should be generated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document gives concrete tax-planning advice such as keeping revenue under thresholds and planning around qualification rules, but it does not warn that eligibility depends on facts, local interpretation, and lawful compliance requirements. Users may rely on the guidance as definitive and take actions that create filing errors, abusive tax positions, or evasion risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger set consists of generic policy-analysis terms ('政策解读', '政策评估', '落地方向', '政策红利', etc.) without contextual guards, making accidental invocation plausible in many enterprise discussions. In a system where skills may auto-activate, ambiguous triggers can route sensitive internal planning or compliance discussions into this skill unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase at line 17 ('对我们有什么影响') is broad and likely to appear in ordinary workplace or planning conversations unrelated to explicit invocation of this skill. That can cause unintended activation, pulling business or policy-sensitive context into the skill when the user did not deliberately request it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The HTML root declares lang="zh-CN", and all visible content is presented only in Simplified Chinese. Under the policy rule for natural-language violations, this is a locale constraint without any opt-in, alternative language option, or stated region-specific justification in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.