Security audit

tech-event-intelligence-engine

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language technology event digest skill with expected web search and webhook delivery behavior, though users should review the automated posting and prompt-injection caveats.

Install only if a Chinese/China-region event digest fits your use case. Before enabling scheduled delivery, verify the webhook destination and audience, and consider adding prompt-injection filtering or human review if the digest will distribute registration links to a team channel.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: assets/workflow.yaml:16
Finding: Untrusted Search Content Is Passed Directly into Agent Instructions
Content: View full analysis
0.85 判定重复，保留信息最全版本。 4. **相关性打分**：按技术匹配度(40%)、主办方权威性(30%)、嘉宾/企业含金量(30%) 计算 0-1 分。低于阈值直接拦截。 5. **格式输出**：按模板生成 Markdown，严格限制条数，缺失字段标注 `[待核实]`。 ``` ### Technical Analysis The workflow forwards raw external search results directly to a natural-language Skill as a single string. Search-result titles, summaries, and related page content are attacker-controlled data. The Skill does not establish a trust boundary between its authoritative instructions and the supplied search content. In particular, it does not instruct the agent to: - Treat every part of `raw_search_data` exclusively as untrusted data. - Ignore instruct ...[truncated 2142 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s natural-language content, including the description, workflow instructions, and output template, is presented only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest-style config uses a space-separated keyword list containing broad terms like '人工智能', '大数据', and '开源' without any constraints, negative examples, or context limiting when they should trigger the skill. These are common topic words that can overlap with ordinary discussion, making activation criteria ambiguous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The config fixes region to '全国' and timezone to 'Asia/Shanghai', alongside Chinese-only keywords, which implies a specific locale without any visible opt-in or explanation in this file. That can violate language/locale policy when users are not offered a choice or the regional restriction is not clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This YAML workflow performs an outbound HTTP POST to a configurable webhook URL and includes digest content derived from search results. In this file there is no accompanying warning, confirmation, or explanatory note that data will be sent externally, which fits the missing-disclosure criterion for a manifest/code-like workflow definition.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON test file embeds expected outputs and validation rules entirely in Chinese, including fixed Chinese report headings like "技术活动情报日报" and a Chinese disclaimer requirement. That indicates a language policy constraint in the skill behavior without any visible user opt-in or configurable language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema's top-level description is written entirely in Chinese, and the parameter descriptions are also Chinese-only. This indicates a language constraint for the skill interface without offering any user language choice or documenting a justified locale-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documentation is written entirely in Chinese and presents the workflow and usage only in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The visible user-facing strings in the card title and buttons are all hard-coded in Chinese, with no indication that users can select another language or that the skill is intentionally limited to a Chinese-only audience. This matches the policy category for language/locale constraints imposed without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language metadata and inline documentation in this skill file are Chinese-only, including the description that communicates the workflow's purpose. Because no language choice, opt-in, or explicit region-specific justification is provided in the file, this may violate a language/locale policy requiring user choice.
Content: No source excerpt is available for this finding.