Security audit

Internal Hub Agent Lab

Security checks for vulnerabilities and agentic risk

Overview

The skill is a shared internal coordination hub, but it can be invoked implicitly and directs agents to publish reusable work and shared skills without enough scoping or user confirmation.

Review before installing if your workspace contains sensitive business, customer, credential, financial, or draft strategy data. Use it only with clear rules for what may be posted to D:\internal-hub, require explicit confirmation before sharing content, and limit who can create or update shared skills under D:\internal-hub\skills.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description is broadly scoped to many normal coordination activities, including posting findings, requests, handoffs, SOPs, and retrospectives. That can cause over-activation and route unrelated or sensitive work into a shared hub, increasing the chance of unnecessary data exposure, policy bypass through an informal channel, or misuse of shared skills.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The posting rules prescribe section names entirely in Chinese, but the document does not state that the skill is region-specific or provide an opt-in language choice. This can create a language policy issue by implicitly requiring a specific language or locale without user selection.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill combines a broad default prompt with allow_implicit_invocation: true, which increases the chance the agent will activate this skill in situations that only loosely relate to collaboration or knowledge sharing. Because the skill routes information into a shared internal hub, unintended activation can cause over-sharing of context, cross-role leakage, or unreviewed publication of intermediate findings into a broader audience than intended.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The instruction to use the skill whenever work should be learned once and reused many times is vague and subjective. Ambiguous activation rules can lead agents to overuse the hub, publishing drafts, internal reasoning, or premature process guidance into a shared location without clear necessity.

Static analysis

No suspicious patterns detected.