Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` - 主文件
Security audit
副业验证 skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Chinese-language side-project validation helper, with small research scripts whose external keyword searches are purpose-aligned but should be understood before use.
Install this if you want a Chinese-language workflow for validating side-project ideas. Be aware that running its scripts can send your search keyword or business idea to third-party services such as Google Trends, GitHub, and Zhihu, so avoid sensitive or confidential terms unless that is acceptable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill references executable shell scripts (
scripts/search-trend.sh,scripts/find-competitors.sh,scripts/research-demand.sh) but does not declare anypermissionsorallowed-toolsscope. This creates an authorization gap where an agent may invoke shell capabilities implicitly or without clear sandboxing expectations, increasing the risk of unintended command execution or misuse if the scripts or their inputs are unsafe.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description and the entire user-facing skill content are written in Chinese, with no indication that other languages are supported or that Chinese is a deliberate region-specific requirement. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger condition includes an open-ended clause like '类似的产品/副业验证需求', which is broad and ambiguous. Overbroad activation can cause the skill to run in contexts the user did not clearly intend, potentially invoking research scripts or producing unsolicited analysis based on loosely related prompts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all headings and guidance in Chinese, which can amount to a language-policy violation if the organization expects skills to avoid forcing a specific language without user opt-in. There is no indication that the content is region-specific or that users can choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is entirely written in Chinese and instructs the user to produce output in that format, but it does not provide any opt-in or alternative language choice. Under the policy for natural-language violations, forcing a specific language without user choice is a reportable locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script's user-facing comments and printed messages are entirely in Chinese, which imposes a specific language on users without offering an opt-in or alternative. Under the policy for natural-language constraints, this is a locale/language restriction that should be either optional or clearly justified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "" echo "--- GitHub ---" curl -s "https://api.github.com/search/repositories?q=$KEYWORD&sort=stars&order=desc&per_page=5" 2>/dev/null | \ python3 -c "import json,sys; d=json.load(sys.stdin) for r in d.get('items',[])[:5]: print(f\"{r['full_name']} ⭐{r['stargazers_count']}\")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing comments and output strings are in Chinese, which imposes a specific language/locale without any opt-in or documented justification. Under the policy, language constraints should either be optional or explicitly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file uses only Chinese-language headings and content throughout, which can constitute a language-policy issue when a skill or reference forces a specific language without user opt-in. There is no indication that the content is intentionally region-specific or that users may choose another language.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This shell script sends the user-provided keyword to an external service via a GitHub API request, but the script does not explicitly warn that input will be transmitted off-system. Although the URL output for other sites is visible, the actual HTTP call happens silently with curl, which reduces user awareness of the data-sharing behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits the user-supplied keyword to Zhihu via a network request without any notice or confirmation. While this is expected for a research tool, the keyword may contain sensitive business ideas, personal data, or confidential market hypotheses, so silent exfiltration to a third party creates a privacy risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing messages and usage instructions in the script are written only in Chinese, which can amount to a language-policy issue when no user opt-in or justification is provided. There is no indication that this skill is intentionally limited to a Chinese-speaking or region-specific environment.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell script sends the supplied keyword to Google Trends via a curl request, which transmits user-provided data to an external service. While the code is simple, there is no explicit warning in comments or runtime output that the keyword will be sent over the network to a third party.
- Content
Static analysis
No suspicious patterns detected.