Security audit

FDE 前沿部署工程师

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed FDE methodology and questionnaire helper; it has broad enterprise-deployment guidance but no hidden execution, exfiltration, or unsafe persistence.

Install only if you want Chinese-language FDE workflow guidance. Before applying it in a customer or regulated environment, confirm written authorization, collect only necessary metadata, avoid copying production data to personal devices, protect secrets in environment files, and require normal change approval, rollback, and compliance review before production deployment or healthcare shadow-mode use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains very broad phrases such as 'FDE', '驻场工程师', '客户现场部署', and '企业AI落地' that could match many ordinary enterprise-assistance requests and cause the skill to activate unintentionally. In an agent ecosystem, overbroad invocation increases the chance that this skill intercepts requests outside its intended scope, which can lead to confusing behavior, prompt-surface expansion, or unsafe application of its guidance in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger list is unusually broad and includes generic enterprise and AI-delivery terms, which can cause the skill to activate in unrelated customer or internal discussions. This increases the chance the assistant will inject deployment/audit guidance into contexts involving sensitive business operations without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: These instructions direct the agent to assess customer environments, inventory data assets, and run an audit script, but they do not require consent checks, data minimization, or handling rules for sensitive information. In a real enterprise setting, that can lead to over-collection of confidential data, privacy violations, or unsafe processing of customer-environment details.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The deployment section recommends prototype development, system integration, UAT, and production rollout guidance without requiring change-control, backup, rollback, or approval gates. If followed naively, this could encourage production-impacting actions or risky integration steps in customer environments without adequate safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该 markdown 文件适用缺少用户警示规则。L099-L101 描述模型“在后台运行，医生看不见”并“收集 3-6 个月数据”，这是会影响数据使用透明度和隐私预期的行为，但文档未附带任何明确警示、同意要求或隐私说明。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains natural-language guidance exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing docstring, prompts, help text, and generated questionnaire content are all written in Chinese, which effectively constrains the skill’s interaction language. There is no indication that users may choose another language or locale, and no documented justification that this skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language content of the README consistently assumes Chinese as the interaction language, and there is no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicit and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file includes a docker-compose template that references OPENAI_API_KEY, DATABASE_URL, and DB_PASSWORD, which are sensitive credentials. Although the document later states that API keys and passwords must not be hardcoded, this section itself does not warn readers to protect, rotate, or avoid exposing these secrets in shared environment files or logs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.