T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
configs/roles/master.yaml:19- Finding
Mandatory Unscoped Retrieval of Persistent User and Team Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
YiHui Agent Swarm
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent multi-agent orchestration template, but it requires broad cross-agent memory recall and automatic persistence of user/session/team information without enough scoping or consent controls.
Review this before installing in any environment with sensitive conversations, operational data, or multiple users. Only use it if MemPalace/Cortex access is scoped by user, tenant, task, and agent role, and if memory writes require validation or explicit approval for preferences, profile data, secrets, incident details, and system-change records.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
configs/roles/specialist.yaml:17- Finding
Automatic Persistence of Unvalidated Task Content and User Preferences
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (22)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly directs storage of conversation preferences, temporary dialogue memory, and user profile data in persistent memory without any user-facing consent, minimization rule, retention policy, or sensitivity filter. In a multi-agent orchestration context, this can lead to silent collection and long-term propagation of personal and contextual data across agents, increasing privacy, compliance, and unauthorized disclosure risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document mandates writing team decisions, system changes, long-term facts, and cross-agent knowledge to persistent storage immediately after confirmation, but provides no warning about recording potentially sensitive operational data. Because the skill is designed for orchestration and may involve security, ops, and diagnosis tasks, persistent storage could capture secrets, infrastructure details, or incident information that later agents can retrieve.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
In the trigger list, "编排" is a generic term that can refer to many ordinary coordination or arrangement tasks, not specifically this multi-agent orchestration framework. The file does not provide narrowing context, exclusions, or negative examples to clarify when this trigger should or should not activate the skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
"任务路由" is a general concept that could match many workflow or project-management discussions, not only this skill's intended usage. Because the manifest does not define boundaries or exclusions for this phrase, it may cause unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The phrase "agent 团队" describes a general topic instead of a clear invocation condition. Without explicit constraints, the skill may activate for ordinary conversation about agent teams rather than requests to use this orchestration framework.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
"角色定义" is a common phrase that can apply to writing, product design, staffing, or many other contexts. The file does not restrict it to agent-role configuration, making the activation condition overly broad.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The role name and all user-facing descriptive text are written only in Chinese, which indicates a fixed language/locale for the skill behavior. The file does not offer any user opt-in or alternative language choice, and no region-specific justification is documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language fields for the role name and description are written only in Chinese, which implies a fixed language/locale for the skill presentation. There is no accompanying opt-in, fallback, or documentation that this role is intentionally limited to Chinese-speaking users or a specific region.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The role name and descriptive instructions are written exclusively in Chinese, which imposes a specific language/locale on the skill behavior. The file does not indicate that this is optional, user-selected, or required for a region-specific use case.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The role explicitly instructs the agent to write domain learnings, significant discoveries, and observed user preferences into persistent memory stores without any consent, minimization, or sensitivity filtering. In a multi-agent orchestration system, this can lead to silent retention of sensitive operational details or personal preference data that may later be exposed to other agents or reused outside the user's expectations.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
yaml - Identify blocker clearly - State = blocked - Report to master immediately - Wait for resolution (don't retry indefinitely) # Reporting report:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The configuration uses Chinese-only agent names, descriptions, and trigger keywords, which effectively constrains operation to one language. There is no indication that users can opt into another language or that the team is intentionally limited to a Chinese-language environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes very common terms such as '判断' and '决定', which can appear in many ordinary requests and are not specific to review or risk-assessment tasks. Because this is a manifest/config file, these vague triggers can cause the critic agent to be invoked in situations outside the intended scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list '[路由, 调度, 分配]' is short and lacks context about where these words must appear or what kinds of requests qualify. In a manifest file, this ambiguity can lead to accidental matches for common coordination language instead of intentional invocation of the master agent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This YAML manifest describes a workflow and example conversation flow, but it does not specify explicit activation phrases, scope boundaries, or negative examples for when the skill should or should not be invoked. Broad inputs such as '用户原始请求' and the generic routing pattern could overlap with many ordinary requests, increasing the risk of unintended invocation in systems that rely on manifest descriptions for activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow name and description are written in Chinese, and the example interaction is also exclusively in Chinese, which indicates a locale/language assumption without any opt-in or documented regional scope. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow name, description, task inputs, outputs, and example conversation are written in Chinese, which indicates a language-specific interaction pattern. There is no accompanying note offering language choice or documenting that the workflow is intentionally limited to Chinese-speaking users or a Chinese-language deployment context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest describes the workflow as handling '复杂任务' requiring coordination, but it does not define specific trigger phrases, scope boundaries, or exclusion conditions. Because the description is broad and the example user request is a natural conversational request, the skill could be matched in situations beyond the intended research workflow.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Overly Broad Trigger: '编排' is too short and may match unintended inputs
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The description and examples are strongly oriented around Chinese-language names and tooling conventions, but the document does not explicitly state whether use of Chinese is required or optional. This can create an implicit language preference without user opt-in.
- Content
Static analysis
No suspicious patterns detected.