Security audit

Deepmine_5.2

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese structured-questioning skill with a disclosed business/tax risk helper, and I found no code execution, persistence, credential access, or data exfiltration behavior.

Install this only if you want a Chinese-language guided questioning agent. Use it deliberately or in a dedicated assistant, since it can take over the conversation flow with multi-turn questions. For business, tax, legal, or compliance topics, treat its risk labels as prompts for professional review, not as legal advice, and avoid sharing sensitive details beyond what is needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (26)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The changelog explicitly states the skill should auto-start after the user sends any request, which creates an overly broad activation surface. In an agent environment, this can cause the skill to intercept unrelated conversations, override more appropriate skills, and apply its prompt logic without clear user intent or consent, increasing the risk of unwanted data elicitation and workflow disruption.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README states that after importing the skill, 'sending any request content will automatically start' the skill, which is an overly broad activation condition. In an agent environment, this can cause unintended invocation on unrelated user inputs, leading to prompt hijacking of normal conversation flow, accidental collection/structuring of sensitive user disclosures, or interference with higher-priority system behaviors.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The extractor skill materially diverges from the manifest’s stated Socratic reflection purpose and instead performs specialized tax/compliance triage. This creates a deceptive capability boundary: users invoking a self-reflection skill may unknowingly have their input reinterpreted into legal/criminal risk screening, which can lead to inappropriate data handling, unsafe advice framing, and policy bypass through skill confusion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file presents the skill entirely as a Chinese-language experience and does not state that users may choose their preferred language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire submission is written as Chinese-only user-facing content, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate that other languages are supported or that Chinese is a justified, region-specific requirement. Under the policy rule for language/locale constraints, forcing a single language without opt-in can constitute a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The entire skill description and control interface are presented only in Chinese, and no language-choice or opt-in mechanism is described. For a general-purpose skill, this can amount to an implicit locale/language constraint without documented user choice or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad trigger phrases such as '帮我想清楚', '我有点纠结', and '我不知道该怎么办', which are common in ordinary conversation and can cause the workflow to activate in situations far beyond its intended use. In an agent environment, this creates prompt-scope overreach: the skill may hijack unrelated conversations, force a rigid questioning loop, and suppress safer or more appropriate handling paths for sensitive requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger guidance says to use the skill when users express indecision or ask for help clarifying thoughts, but the boundaries for non-use are still vague and under-specified. Because the skill is designed to take over dialogue structure across multiple turns, ambiguous invocation guidance increases the risk of inappropriate routing, degraded user experience, and mishandling of cases that should instead receive direct answers or specialized safety treatment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructions, categories, examples, and required output content are all written in Chinese and require generated fields such as titles and details in Chinese, but there is no indication that the user can opt into another language. This creates a language-policy concern because the skill effectively enforces a specific locale without documenting a justified regional constraint or providing a choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill introduces criminal-redline and compliance screening that is not justified by the parent skill’s declared purpose, increasing the chance that ordinary reflective conversations are silently escalated into legal-risk classification. In context, this is dangerous because it can misclassify benign user statements, elicit or process sensitive allegations, and produce quasi-legal judgments without informed user intent or proper safeguards.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s instructional content is entirely in Chinese and explicitly constrains all handler output via shared tone rules, implying the skill operates in Chinese by default. This is a natural-language locale constraint, and the file does not offer the user any language choice or explain a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language instructions are written entirely in Chinese and explicitly require that all output follow this handler's format, with no indication that language should match user preference or that another locale is allowed. This creates a locale policy concern because the skill appears to force a specific language without user opt-in or a documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s natural-language instructions and required output examples are entirely in Chinese, including mandated user-facing phrases such as the closing line. This creates a language/locale policy concern because the skill appears to require Chinese responses regardless of the user’s preferred language, and the file does not provide any opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s operative instructions are written in Chinese and line L07 says all output must follow a fixed response format, with no indication that the skill should adapt to the user’s preferred language. This can constitute a language/locale policy violation because it implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The handler’s natural-language instructions and required output constraints are specified entirely in Chinese, which imposes a language/locale assumption without any opt-in or documented regional scope. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes Chinese-only operating instructions and output behavior without any user-language negotiation or documented business need. This can cause unsafe or unusable interactions for non-Chinese users, who may be unable to understand prompts, summaries, or control flow, increasing the risk of misunderstanding high-stakes decisions or consent-related inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is entirely written in Chinese and defines the interaction rules and examples in that language, which effectively constrains the skill to a specific locale without any explicit user opt-in or fallback behavior. In a multilingual agent environment, this can cause user exclusion, misunderstanding of prompts, and reduced reliability if the user expects another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes Chinese-only onboarding and control instructions without offering any language selection, fallback, or confirmation of user preference. This can exclude or confuse users who do not read Chinese, causing miscommunication around consent-like control phrases such as pause, switch topic, or summarize, and weakening the user's ability to safely control the interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file is written entirely in Chinese and operationally assumes Chinese-language interaction without any indication that the user can choose another language. This can cause users to misunderstand prompts, consent less clearly to the interaction style, or receive degraded service if they are not Chinese speakers, which is a real safety and accessibility issue even though it is not a code-execution risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: SQP-3 适用于所有文件类型。整个文件以中文定义对话框架、示例话术和输出路由，但未说明这是用户可选语言，也未声明该技能仅面向中文场景，可能构成未获用户选择的语言/locale 约束。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该 markdown 文件适用 SQP-1。场景三的典型开场包含“帮我做个方案”“这件事我想做，但不知道从哪下手”等宽泛表述，和日常求助语句高度重叠，缺少更明确的领域约束或排除条件，容易让技能在非目标场景下被触发。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L03 states that every reply must append a state block and the surrounding specification is written with fixed Chinese field content such as 当前锚定主题, 显现 | 加工 | 外化, and 未明确, implying a required Chinese-language format. This enforces a specific language/locale behavior without any user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that the skill is limited to a Chinese-speaking audience or that users may opt into another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents all instructions and examples exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language option is provided. The content does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.