Back to skill

Security audit

SBTI(Sociability, Boldness, Thinking, Independence)人格测试,聚焦**社交性**、**果敢度**、**思维模式**、**独立性**四大核心维度,精准刻画人格特质。 本技能将专业测评体系 AI 化,无需复杂操作,即可快速完成测试并生成结构化报告,帮你深度认识自我、优化人际互动、明确职业方向,解决自我探索、职场适配、人际沟通等高频需求。

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SBTI personality quiz with no hidden code, network use, persistence, or credential access, though it asks personal questions and uses broad triggers.

Install only if you are comfortable answering provocative Chinese-language personality and relationship questions. Treat the output as entertainment, not psychological or career advice, and trigger it explicitly with SBTI wording to avoid accidental activation from generic personality-test phrasing.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description and all user-facing instructions/questions are presented only in Chinese, which effectively forces a specific language experience. Under the language/locale policy, this should either provide user opt-in/choice or clearly document that the skill is intended for a specific language audience.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases include very generic terms such as '人格测试' and '人格分析', which can cause the skill to activate during ordinary conversation unrelated to this specific SBTI quiz. That increases the chance of unintended invocation, confusing users and causing the agent to collect sensitive personal or psychological-style responses without sufficiently explicit intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The README’s substantive instructions and skill description are entirely in Chinese, while only a link to an English file is provided rather than an explicit in-skill language choice or opt-in. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.