Security audit

市场营销助手（Marketing Assistant）

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language marketing assistant skill that generates drafts, plans, and review materials with human approval controls, and I found no hidden execution, exfiltration, or destructive behavior.

Before installing, confirm that the Feishu bot, Hermes Agent skills, knowledge bases, audit logs, and archive directories are limited to authorized marketing users. Do not submit confidential customer, contract, financial, or unreleased technical material unless your organization has configured masking, retention, approval, and access controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documentation is entirely written as a Chinese-only employee/skill interface and names a specific Chinese entry point, but it does not indicate that language choice is optional or that the skill is limited to a China-specific compliance or regional context. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase '默认使用以下结构输出' appears in a Chinese-only skill document and presents the default response behavior without any option for user language preference. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire demo script, including the invocation example and workflow instructions, is written only in Chinese and assumes a Chinese-language interaction with “小宣”. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This manifest says the skill receives topics, materials, and promotion needs through Feishu to perform a wide range of marketing tasks, but it does not specify concrete invocation phrases, channel constraints beyond Feishu, or negative examples for when it should not activate. In a manifest file, such broad natural-language activation scope can cause unintended invocation from ordinary marketing conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains operational instructions exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt is written entirely in Chinese and instructs the assistant's behavior in that language, but it does not offer the user any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire report template is written only in Chinese, which imposes a specific language/locale on generated output. The file does not indicate that language selection is optional or user-configurable, so it can violate language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template, including the title and field labels, is written only in Chinese, which imposes a specific language/locale on users. There is no indication that the user can choose another language or that this locale restriction is justified by a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. This creates a natural-language locale policy concern because it effectively forces a specific language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown template uses Chinese headings and review labels throughout, which imposes a specific language on users. There is no accompanying note that this skill is intended only for Chinese-language workflows or that users may choose another language, so it conflicts with the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow explicitly states that user-submitted text and attachments are received, parsed, logged, and archived, but the skill description does not disclose any user-facing notice about how that data is stored, retained, or used. In a marketing assistant context, submitted materials may contain customer lists, campaign plans, contract details, or other sensitive business information, so silent logging/archiving increases privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The workflow retrieves knowledge-base content and processes user materials, yet provides no explicit warning against submitting sensitive data and no disclosure of how retrieved and uploaded content may be combined, stored, or exposed to downstream components. This can lead to unintended disclosure of internal business data or personal information, especially because the skill is designed to ingest free-form text and attachments from collaboration tools.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest presents the skill name, owner, deployment channel, and mission entirely in Chinese and does not state that language is configurable or limited to a China-specific business context. This can violate language/locale policy when a skill appears to require a specific language without user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file is entirely written in Chinese and presents the skill documentation in a single language without indicating that language choice is optional or that the skill is intended only for a Chinese-language audience. Under the language/locale policy check, this can be considered a natural-language policy issue because it implicitly enforces one language without opt-in or explicit regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest consistently presents skill-facing natural-language metadata in Chinese only, with no indication that users may opt into another language or that the skills are limited to a Chinese-speaking or China-specific environment. Under the stated policy, a forced language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file title and description are entirely in Chinese, presenting the skill materials in a fixed language with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language locale policy concern because the skill appears to enforce a language choice without opt-in or justification.
Content: No source excerpt is available for this finding.