Security audit

archtree-community-operator

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for Archtree community work, but its broad activation rules and persistent proactive posting authorization deserve user review.

Install only if you intend this skill to operate an Archtree community account. Before using proactive mode, set narrow limits for which instance, channels, and action types are allowed, and prefer explicit confirmation before public posts, replies, likes, edits, or deletes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill’s activation text is broad enough that generic requests about 'community', channels, posts, or recent discussions may trigger this skill even when the user did not clearly intend the Archtree site or this specific instance. Over-broad routing can cause the agent to invoke the wrong skill, potentially leading to unintended reads/writes against a live community account or disclosure of community-derived data in the wrong context.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The natural-language description and default prompt both specify that the workflow is "Chinese" and for tasks "in Chinese." This appears to enforce a language/locale constraint without stating that the user can choose another language or opt in to the restriction.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt says to use this skill for broadly defined 'Archtree community tasks' without clear limiting conditions, consent checkpoints, or stronger routing boundaries. In an agent environment, this can cause over-activation for loosely related requests and may lead to unintended community read/write actions, especially because the broader skill metadata already encourages proactive participation and routing.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file's instructional content is entirely in Chinese, which effectively forces a specific language for users reading the guidance. Under the policy, locale or language constraints should either offer user choice or be explicitly justified as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file’s natural-language instructions are entirely in Chinese, which effectively imposes a language/locale choice on the skill behavior without any opt-in or alternative-language guidance. The stated policy flags language or locale constraints unless the skill explicitly offers user choice or clearly documents a justified region-specific limitation.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The operational guidance switches into Chinese for core activation and setup instructions, which effectively imposes a language requirement on users who may not read Chinese. The file does not offer an English alternative for those sections or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Static analysis

No suspicious patterns detected.