Security audit

Auto Llm 4840

Security checks for vulnerabilities and agentic risk

Overview

The skill looks like a Bilibili learning/tutorial helper, but running it silently writes input into a persistent knowledge base through an undeclared local Python dependency.

Review before installing. This skill should only be used if you intend it to write learning content into a local knowledge base and you trust the local `D:\\coze-local\\db\learn` module. Avoid passing sensitive text to it, and prefer a version with explicit opt-in storage, narrower triggers, and packaged/auditable dependencies.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: auto_llm_4840.py:8
Finding: Unvalidated User Input Is Written to Persistent Agent Knowledge
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: auto_llm_4840.py:5
Finding: Hard-Coded External Directory Takes Precedence During Python Module Resolution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase llm/agent is broad and underspecified, so ordinary discussion about LLMs or agents could unintentionally activate this skill. In an agent framework, ambiguous activation increases the chance of inappropriate routing, context leakage, or execution of the wrong skill when the user did not clearly request it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation text includes an incomplete quoted trigger and lacks clear boundaries for when the skill should run. Truncated or partial phrases can match accidental user input, making the skill easier to trigger unintentionally and increasing the risk of misrouting or unexpected behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents itself as a tutorial/instructional skill, but its actual behavior silently imports a local module and persists content into a KnowledgeBase. This mismatch between declared purpose and runtime behavior can mislead users and reviewers, reducing informed consent and making hidden data collection or persistence harder to notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill writes user-provided input from param into a persistent KnowledgeBase without notice, validation, or consent. Even if the input is only stored as text, this can capture sensitive user data unexpectedly and create privacy, retention, or downstream prompt/data-poisoning risks in systems that later consume the stored knowledge.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The entire skill description and trigger documentation are presented only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional. This can violate language-choice policy when the skill is not clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The module docstring, function docstring, and printed user-facing message are all fixed in Chinese. This can violate language/locale policy when a skill forces a specific language without giving the user an option to choose or indicating that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.