Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent Chinese local-business marketing assistant, but it under-discloses external data-sharing and uses mutable hosted code and mandatory consultant lead-generation paths.
Review before installing. Use the diagnostic advice only if you are comfortable with external feedback/contact prompts, do not send screenshots or business data to WeChat/Notion unless you intend to share it, and avoid the hosted/CDN diagnostic links unless they are pinned or audited. Treat the marketing examples as advice to check against platform, privacy, and consumer-protection rules.
templates/diagnosis-standalone.html:149Mandatory Consultant Promotion Injected into Diagnostic Outputs
加微信 15610568699，发送诊断结果截图
免费帮你分析一次，看看怎么落地执行
templates/diagnosis-report-template.html:7Execution of Mutable and Unpinned Remote JavaScript
The file declares a China-wide e-commerce operations expert, which materially exceeds the parent skill's stated local-business live-operations assistant scope. Scope drift is dangerous because it can cause the agent to perform unintended high-impact business guidance outside user expectations and outside any controls, review, or consent model implied by the manifest.
The file’s declared role and behavior are materially unrelated to the parent skill’s stated purpose of assisting local-business livestream operations. This kind of scope divergence is dangerous because it can cause the agent to activate the wrong expertise, produce unauthorized business guidance, and bypass user or operator expectations about what the skill is supposed to do.
The file defines a broad livestream e-commerce coaching skill that materially exceeds the manifest’s stated local-business assistant scope. This scope drift is dangerous because users or downstream agents may invoke capabilities they did not expect, including platform-specific growth and sales tactics, weakening trust boundaries and governance over what the skill is allowed to do.
The file’s declared role is a broad short-video editing coach, which does not match the parent skill’s stated purpose of a local-business operations assistant focused on diagnosis, livestream prep, and business review workflows. This scope drift is dangerous because it can cause the agent to activate capabilities outside user expectations and governance boundaries, increasing the chance of unauthorized or poorly supervised advice paths.
The manifest describes an AI assistant for local-business owners focused on store diagnosis, short-video scripts, livestream preparation, pre-live talking points, data review, and Q&A. This file instead defines a Xiaohongshu content-operations specialist centered on seeding notes, KOL/KOC collaboration, ad planning, and brand reputation on a different platform, which is a substantial semantic mismatch rather than an implementation detail.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
解决方法： 发布前从目录中删除这些文件，或从临时目录发布：
rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
解决方法： 发布前从目录中删除这些文件，或从临时目录发布：
rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
解决方法： 发布前从目录中删除这些文件，或从临时目录发布：
rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf /tmp/publish-temp && mkdir -p /tmp/publish-temp
cp -r source-dir/* /tmp/publish-temp/
rm -rf /tmp/publish-temp/.git /tmp/publish-temp/*.zip /tmp/publish-temp/*.bat
skillhub publish /tmp/publish-temp
The document frames the promotion around a celebratory story while specifically advising staff not to disclose that the yogurt is near expiry, which withholds a material product fact from customers. In a local retail/food-sales skill, this is especially dangerous because it encourages deceptive marketing around perishable goods and can mislead consumers about why the item is discounted.
The display name, description, trigger phrases, and all user instructions are written exclusively in Chinese, and the trigger routing depends on Chinese phrases. There is no statement that the skill is China-specific or that users may choose another language, which can violate language/locale policy expectations.
The description promises that the AI can act from 'one sentence' and lists vague trigger phrases, encouraging loose intent matching without clear boundaries. In practice this makes accidental invocation and cross-mode prompt capture more likely, though the direct security impact is limited.
The routing table uses broad natural-language triggers such as '看看我的店', '我的店有问题', '复盘', and '数据', which can match ordinary conversation and unintentionally invoke skill behavior. This increases the chance of prompt squatting or unintended mode switching, especially in shared assistant contexts where casual phrases may be misinterpreted as commands.
The skill instructs users to send a literal file path to the assistant ('请读取 ~/.codebuddy/skills/local-business-live-cycle/SKILL.md'), revealing local skill installation structure and encouraging direct path-based resource access. This can aid environment enumeration and normalize behavior where prompts request local file reads, which may be abused in broader prompt-injection scenarios.
WorkBuddy 新开会话时，skill 不会自动加载。复制下面这句话发送即可激活：
请读取 ~/.codebuddy/skills/local-business-live-cycle/SKILL.md
然后按里面的流程帮我诊断门店。
我说「写视频」转口播模式，说「复盘」转复盘模式。
The installation-path section discloses precise local locations for WorkBuddy and Hermes skill files and references installation commands. This leaks environment structure that could help an attacker tailor prompt-injection or social-engineering payloads around expected directories and skill-loading conventions.
> 激活后，直接说「帮我诊断门店」就能用。
**安装路径确认：**
- WorkBuddy: `~/.codebuddy/skills/local-business-live-cycle/SKILL.md`
- Hermes: `~/.hermes/profiles/deepseek-v4/skills/consulting/local-business-live-cycle/SKILL.md`
- SkillHub 安装: `skillhub install local-business-live-cycle`
The file explicitly claims 'diagnostic data only exists locally' while elsewhere directing users to external Notion, GitHub Pages, and jsDelivr endpoints for feedback and tool usage. That creates a misleading privacy representation and can cause users to disclose business or operational data off-platform under false assumptions.
The skill explicitly instructs users to enable location tagging when publishing but does not warn about privacy, stalking, doxxing, or business-security risks. For small business owners and staff appearing on camera, encouraging precise location disclosure can expose real-world whereabouts and routines to unintended audiences.
The trigger phrases include broad everyday-language Chinese activations such as “实体获客” and “帮我写个获客脚本”, which can cause the skill to activate unexpectedly in normal conversations. This increases the chance of unintentional invocation and unsolicited guidance, especially in multi-skill environments where routing is based on fuzzy matching.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
⚠️ 发布时务必打开位置定位，这样周边人群才能刷到。
触发方式：/entity-copywriter、「实体获客」「帮我写个获客脚本」「实体店怎么做短视频」
Entity short-video script generator for local business customer acquisition.
Trigger: /entity-copywriter, "write a customer acquisition script"
---
# entity-copywriter：实体获客文案助手
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
⚠️ 发布时务必打开位置定位,这样周边人群才能刷到。
触发方式:/entity-copywriter、「实体获客」「帮我写个获客脚本」「实体店怎么做短视频」
Entity short-video script generator for local business customer acquisition.
Trigger: /entity-copywriter, "write a customer acquisition script"
---
# entity-copywriter:实体获客文案助手
The later instruction to publish with a specific address repeats and operationalizes precise location disclosure without any consent or safety caveat. Repetition makes the risky behavior more likely, and the instruction shifts from general tagging to exact-address publication, which heightens physical privacy exposure.
The skill name and description define the assistant as a China e-commerce operator expert focused on Chinese platforms and implicitly Chinese-language operation. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified as region-specific; here the locale focus is present, but no user choice or opt-in is offered.
The skill instructs sending CRM messages to existing customers without mentioning consent, lawful basis, opt-out handling, or privacy obligations. In this context, the omission is risky because it normalizes direct customer outreach using potentially personal data and could lead users to misuse stored contact information.
The skill expands into ad operations, CRM outreach, customer databases, supply-chain planning, logistics, and financial management, well beyond the advertised six-mode assistant. This creates a governance and safety issue because the agent may advise on sensitive operational domains without corresponding disclosures, safeguards, or user approval.
No suspicious patterns detected.