Security audit

name: cccfindg

Security checks for vulnerabilities and agentic risk

Overview

This skill performs an authenticated internal directory lookup and returns employee identifiers and phone numbers, but its public description and authorization boundaries are too unclear for automatic approval.

Install only in an environment where users are authorized to access and disclose this internal directory data. The skill should be revised to clearly disclose its authenticated directory access in the manifest, restrict lookups to approved business purposes, and avoid returning mobile numbers or employee IDs unless necessary.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest/description materially understates the skill’s behavior: instead of merely collecting user input and waiting for confirmation, the file defines a workflow that opens an internal corporate directory, handles login state, navigates the UI, searches org structures, paginates results, and extracts employee contact records. This mismatch is dangerous because it can bypass user/admin expectations and review controls, increasing the chance that sensitive internal data access is granted to a skill whose declared purpose appears much narrower.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs the agent to disclose directory data including employee number, name, desk phone, and mobile phone in plain output. In an internal address-book context, this materially increases the risk of privacy violations, insider misuse, targeted phishing, harassment, and unauthorized aggregation of staff contact data; the context makes it more dangerous because the data appears to come from an authenticated corporate system.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to extract and return employee identifiers and contact details, but it provides no user-facing privacy notice, purpose limitation, or authorization check before disclosure. That creates a direct risk of exposing internal personal data to unauthorized requesters or for unapproved purposes, especially because the output is designed for plain-language disclosure.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The description and all required user prompts are written as mandatory Chinese-only instructions, including exact phrases the agent must send. There is no indication that the user may choose another language or that the Chinese-only requirement is a documented, justified locale constraint.

Static analysis

No suspicious patterns detected.