Security audit

prompt-ab-lab

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local prompt-comparison helper with disclosed behavior and no evidence of hidden network access, credential use, persistence, or destructive actions.

Before installing, users should know that the skill may activate on general prompt-comparison requests and can create a CSV when its helper script is used. Review the output path before running the script if you do not want files written in the current directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger examples include very broad natural-language phrases such as '哪个 prompt 更好' and '建一个评测表', which can overlap with ordinary conversation and cause the skill to activate unintentionally. In an agent environment, over-broad invocation can lead to unexpected workflow execution, confusing outputs, or unintended handling of user-provided files and evaluation artifacts even though the README otherwise describes local-only behavior.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The skill lists multiple trigger phrases entirely in Chinese alongside English, and the suggested prompts repeat the same pattern, but nowhere states that users may interact in their preferred language. This can constitute a language/locale policy issue because the skill appears to privilege a specific language without explicit opt-in or documented justification.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: These example trigger phrases are ambiguous, common-language requests that overlap with normal conversation and many other prompt-engineering tasks. That increases the chance of accidental or incorrect activation, which can undermine predictable skill selection and create opportunities for prompt-routing mistakes in multi-skill environments.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase on this line is broad enough to match ordinary user requests about comparing prompts, which can cause the skill to activate unintentionally. While this is not directly exploitable like code execution, it can lead to incorrect routing, context confusion, or untrusted skill invocation when a user did not explicitly intend to use this skill.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown file presents the operational instructions entirely in Chinese, including headings and validation steps, without offering a language choice or documenting that the skill is intentionally region-specific. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The skill description presents core usage sections in Chinese while some operational content is in English, but it does not state whether the user may choose output language or locale. This can be a language-policy issue if the organization requires avoiding implicit language defaults without user opt-in.

Static analysis

No suspicious patterns detected.