local-business-live-cycle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches a local-business marketing advisor, but it embeds under-disclosed commercial handoffs, external data-sharing prompts, remote JavaScript, and local file/process side effects that users should review before installing.

Install only if you are comfortable with a Chinese local-business consulting workflow that may save merchant reports locally and direct users to Notion or WeChat. Do not send report screenshots or merchant metrics externally unless the merchant consents and sensitive details are redacted. Generated HTML reports should avoid loading remote scripts unless dependencies are pinned or bundled locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:197

Finding

Mandatory External Lead-Generation Funnel Injected into Diagnostic Reports

Content

View full analysis

📮 Need in-depth human analysis?

Add WeChat 15610568699, and send a screenshot of the diagnostic result
Receive one free analysis to determine how to implement the recommendations

'+ ``` ### Technical Analysis The Skill changes the expected diagnostic-report behavior by requiring the Agent to append a fixed external contact channel. This solicitation is not technically necessary to calculate a score, provide recommendations, or generate a local report. The project’s publishing record confirms that this behavior is an in ...[truncated 2222 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: templates/diagnosis-report-template.html:7

Finding

Unpinned Third-Party JavaScript Is Retrieved and Executed from a CDN

Content

View full analysis

``` ### Technical Analysis The generated report loads Chart.js directly from jsDelivr without an exact package version or Subresource Integrity hash. The URL can resolve to a different package release over time, meaning the code executed by the report is not necessarily the same code that was present during the Skill audit. JavaScript loaded through a `

Remediation

View remediation

``` 4. Recalculate and review the integrity hash only as part of an explicit dependency update. 5. Add a restrictive Content Security Policy that permits scripts only from approved local resources or an exact trusted CDN. 6. Avoid allowing arbitrary outbound connections through the policy; define a restrictive `connect-src`. 7. Generate static chart graphics or use local SVG/CSS when possible, eliminating runtime JavaScript. 8. Document the exact dependency version and perform periodic vulnerability and provenance reviews. 9. Ensure reports remain functional offline so opening a local report does not require remote code execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp is a destructive recursive deletion command presented as routine setup, with no warning or validation guidance. In a documentation context for publishing workflows, users may copy it blindly, and if the path variable or command is modified incorrectly, it can delete unintended files or directories.

Content

Scanner excerpt · references/skillhub-publishing-guide.md (reported line 38)May include surrounding context.

解决方法： 发布前从目录中删除这些文件，或从临时目录发布：

bash

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp is a destructive recursive deletion command presented as routine setup, with no warning or validation guidance. In a documentation context for publishing workflows, users may copy it blindly, and if the path variable or command is modified incorrectly, it can delete unintended files or directories.

Content

Scanner excerpt · references/skillhub-publishing-guide.md (reported line 38)May include surrounding context.

解决方法： 发布前从目录中删除这些文件，或从临时目录发布：

bash

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This combined deletion command force-removes multiple path patterns and is dangerous because shell globs and recursive deletion can behave unexpectedly, especially in automated or agent-assisted environments. The skill context is publishing guidance, not system administration, so destructive commands are less expected and more likely to be copied without scrutiny.

Content

Scanner excerpt · references/skillhub-publishing-guide.md (reported line 40)May include surrounding context.

bash

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This combined deletion command force-removes multiple path patterns and is dangerous because shell globs and recursive deletion can behave unexpectedly, especially in automated or agent-assisted environments. The skill context is publishing guidance, not system administration, so destructive commands are less expected and more likely to be copied without scrutiny.

Content

Scanner excerpt · references/skillhub-publishing-guide.md (reported line 40)May include surrounding context.

bash

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This combined deletion command force-removes multiple path patterns and is dangerous because shell globs and recursive deletion can behave unexpectedly, especially in automated or agent-assisted environments. The skill context is publishing guidance, not system administration, so destructive commands are less expected and more likely to be copied without scrutiny.

Content

Scanner excerpt · references/skillhub-publishing-guide.md (reported line 40)May include surrounding context.

bash

rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly tells the operator to save chat records to a case file, but it provides no guidance on obtaining merchant consent, minimizing personal data, or handling retention and access controls. In this business-diagnosis context, conversations may include business metrics, account status, operational constraints, and potentially identifiable contact details, so storing them without privacy safeguards creates a real data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The display name, instructions, triggers, and examples are all presented exclusively in Chinese, with no indication that users can choose another language or that the locale restriction is required. This can violate language or locale policy where skills should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says "说一句话就自动诊断门店" and lists triggers including broad phrases like "写视频" and "店怎么做抖音". Such phrases can easily appear in normal discussion and the manifest does not clearly constrain when they should invoke this skill versus being treated as general conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The routing table uses broad natural-language triggers such as "看看我的店", "数据", "效果怎么样", and "不会用/卡住了" to select modes. These phrases are common in ordinary conversation and the file does not provide exclusion conditions or negative examples, so the skill could activate or switch modes when the user did not intend it.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 92% confidence

Finding

The skill includes explicit local installation paths and activation instructions that reveal the agent's skill directory structure. This environment disclosure helps an attacker craft more targeted prompt injections, path-probing, or social-engineering instructions by giving precise knowledge of where sensitive skill files are expected to live.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

WorkBuddy 新开会话时，skill 不会自动加载。复制下面这句话发送即可激活：

text

请读取 ~/.codebuddy/skills/local-business-live-cycle/SKILL.md
然后按里面的流程帮我诊断门店。
我说「写视频」转口播模式，说「复盘」转复盘模式。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 94% confidence

Finding

The installation-path section exposes platform-specific skill locations for WorkBuddy and Hermes, plus the package name used to install the skill. This materially increases attack precision by enabling environment enumeration and more convincing malicious prompts that reference real paths and tooling conventions.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

> 激活后，直接说「帮我诊断门店」就能用。

**安装路径确认：**
- WorkBuddy: `~/.codebuddy/skills/local-business-live-cycle/SKILL.md`
- Hermes: `~/.hermes/profiles/deepseek-v4/skills/consulting/local-business-live-cycle/SKILL.md`
- SkillHub 安装: `skillhub install local-business-live-cycle`

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells users that diagnostic data 'only exists locally' while also directing them to remote Notion, GitHub Pages, and jsDelivr resources as part of normal use and feedback. This creates a misleading privacy assurance: even if the core file is local, users may disclose business data through external pages or remote content may influence outputs, so the statement can cause unsafe trust and unintended data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The title and description are written as an internal consultant manual for a Chinese business workflow, and throughout the document the instructions assume Chinese-language operation. There is no statement offering a language choice or clarifying that the locale restriction is intentional and region-specific, which can violate language/locale policy when a skill effectively forces one language by default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manual explicitly instructs the agent to generate HTML reports, save them to the local desktop, and invoke Chrome headless to render PDFs. That goes beyond a purely advisory assistant and creates undisclosed side effects on the host system, including file creation and process execution, which can surprise users and be abused for unwanted local actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual directs saving merchant reports to the user's desktop and generating PDFs without any user-facing warning or consent flow. Silent local file creation can leak sensitive business data into unmanaged locations, overwrite expected workspace hygiene, and violate user expectations about what the assistant may do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions to open local files and use Chrome headless imply execution of a local browser/process without disclosure. Launching local processes is a meaningful side effect with security and privacy implications, especially when rendering generated HTML that could later include active content or external dependencies.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The version history introduces a remotely hosted diagnostic tool served from an external CDN/GitHub Pages URL that is not reflected in the skill description. Undisclosed external service usage expands the trust boundary, can change behavior without review, and may expose user or merchant data to third-party infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The default and quick prompts are generic user phrases like 'Diagnose my store' and 'Write a video script', which are broad enough to be invoked unintentionally in normal conversation. This can cause accidental skill activation, leading to unwanted context capture, confusing agent behavior, or unexpected actions in multi-skill environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains end-user-facing guidance and example dialogue only in Chinese, effectively forcing a specific language for use of the skill content. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire workflow document is written in Chinese and describes the tool flow solely for Chinese-speaking users ('老板', '微信成交') without any indication that users may choose another language or that the tool is intentionally limited to a Chinese-only/regional context for compliance reasons. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The publish log shows the skill was intentionally modified to add a multi-step lead-generation funnel: fixed contact placement, WeChat prompts, screenshot handoff, and paid conversion paths. This exceeds the declared scope of a local-business operations assistant and indicates hidden commercial redirection behavior embedded into the skill flow, which can mislead users and exfiltrate conversations off-platform.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation example "说『帮我诊断门店』" is a natural-language trigger in a markdown file, but the document provides no scope limits, exclusion conditions, or negative examples. This makes activation potentially ambiguous because the phrase could be used in ordinary conversation without clarifying the exact context in which the skill should or should not run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document includes destructive shell deletion commands as copy-pasteable guidance without any warning, validation step, or safer alternative. Even though the paths shown are not obviously system-critical, users or downstream agents may adapt the pattern incorrectly, and recursive forced deletion can cause unintended data loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The evaluation text states that the core functionality is clearly in Chinese while some auxiliary modules are in English, implying a fixed language behavior rather than offering users a language choice. Because no opt-in or locale justification is provided in the file, this may conflict with language or locale choice expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown explicitly states the skill is easy to start by saying “帮我诊断门店”, but it does not define activation boundaries, exclusions, or alternative non-trigger usage. This phrase is broad enough to overlap with ordinary conversational requests about store diagnosis, which could cause unintended invocation in general discussion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.