Back to skill

Security audit

心理学研究设计助手

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only psychology research design assistant with no code execution, persistence, credentials, or hidden data access.

Install this if you want a Chinese-language assistant for psychology research design and review. Before relying on its output, verify any cited literature, measurement scales, legal or ethics requirements, and institution-specific approval obligations yourself; the skill says it does not replace ethics approval or clinical judgment.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and it does not state that the skill supports other languages or that Chinese output is optional. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The display name, short description, and default prompt are all written exclusively in Chinese, which indicates the skill is intended to operate in a fixed language. There is no visible opt-in, language-selection mechanism, or justification that this is a region-specific tool, so this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill example is written in Chinese and does not indicate that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's instructional content is entirely in Chinese, including the title, prompt, routing guidance, and output requirements. This can constitute a language-policy violation because it forces a specific language without any user opt-in or explanation that the skill is intended only for Chinese-language use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill example is written in Chinese and provides no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire checklist is written only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The entire skill content is written in Chinese, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all user-facing instructional content exclusively in Chinese, which can amount to a language-policy violation when no opt-in or locale justification is provided. The file does not indicate that the skill is region-specific or that users may choose their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill file is written in Chinese and presents guidance exclusively in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file presents all instructions and guidance exclusively in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are explicitly justified or when users are offered a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown template is written entirely in Chinese, including the title and authoring instructions, which effectively constrains the skill's output language. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose, so it appears to impose a locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill example is written in Chinese and presents its prompt and expected routing/output only in that language, with no indication that the user can choose another language. Under the policy rule, forcing a specific language without opt-in or clear region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. That can violate a language/locale policy if skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill file is written in Chinese and provides no indication that users may choose another language or opt in to this locale. Under the policy, a skill that enforces a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire skill file is written in Chinese and provides no indication that the user may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file uses Chinese throughout and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown template uses Chinese section headings throughout, which indicates a fixed output language. The policy forbids forcing a specific language without user opt-in, and this file does not provide any language choice or documented locale-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown template is primarily written in Chinese but includes fixed English labels such as 'STANDARD / DEEP', 'Research Design Audit', and severity terms 'Critical, Moderate, Minor'. That imposes a mixed language/locale output style without explicitly offering the user a language preference or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.