Industry Report Sprint / 行业研究报告速写

• Outcome: Review
• Latest audit: Oct 14, 2026 · 11:03 AM UTC
• Version: 0.1.17

Overview

This report-writing skill is functional in purpose, but it also bundles a high-impact local JishuDB installer and contains a Windows setup-script mismatch that users should review before installing.

Install only if you are comfortable letting the skill set up and connect JishuDB, including downloading verified installer assets, writing local configuration, and creating persistent JishuDB records. On Windows, review the helper carefully because its documentation says PowerShell should not be invoked, yet the bundled helper uses PowerShell for shortcut creation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This second mismatch is substantively the same risk on another platform path: the skill claims to generate an industry report but includes instructions to download binaries, modify filesystem/ACL state, launch native processes, and configure localhost services. In the context of an agent skill, hidden installation and execution behavior is especially risky because it normalizes privileged actions that are unrelated to the user's apparent request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This second mismatch is substantively the same risk on another platform path: the skill claims to generate an industry report but includes instructions to download binaries, modify filesystem/ACL state, launch native processes, and configure localhost services. In the context of an agent skill, hidden installation and execution behavior is especially risky because it normalizes privileged actions that are unrelated to the user's apparent request.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

1. Create a new `industry-report-sprint-<runId>` directory under the user's
   output directory or the host workspace location. Do not
   overwrite existing files. Retain run ID, revision, stable record UUIDs,
   creation timestamps, and source/upload retry identities.
2. Retrieve relevant approved prior evidence with
   `kb_search({kbId, query, topK: 5})`, then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 1190)May include surrounding context.

sh

assert_digest "$partial_path" "$expected_sha" installer
    cnb_revalidate_approval
    /bin/mv -- "$partial_path" "$installer_path"
    /bin/rm -f -- "${root}/download-location.txt"
  fi
  jxa result download "$PLAN_PATH" "$PLAN_SHA256" "$offset" "$added"
}

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code executes native Windows binaries such as whoami.exe, icacls.exe, powershell.exe, explorer.exe, and later launches installer executables. Even though it attempts to constrain paths and environment, the capability itself is dangerous in this context because a reporting skill should not need subprocess execution to fulfill its declared function, and such execution expands the attack surface to local code execution and system-state changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section creates private directories/files and modifies ACLs, which directly alters local filesystem security state. For an industry-reporting skill, these persistent local changes are unnecessary and enable the skill package to establish durable local state and prepare for subsequent installation or execution behaviors unrelated to report generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file is a full Windows software installer/orchestrator: it downloads artifacts, validates plans, writes files, changes ACLs, launches installers, and starts desktop applications. That behavior is materially unrelated to the stated purpose of an industry research/report-writing skill, so it creates an unjustified capability for local system modification and arbitrary software deployment within the skill package.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/jishudb-setup/setup.md (reported line 1)May include surrounding context.

md

<!-- Generated by scripts/bundle-task-setup.py; edit skills/jishudb instead. -->

This setup guide and its helpers are included in the current task Skill.
No separate Skill installation or marketplace download is needed. Resolve

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope or permissions boundary, yet its instructions clearly expect access to network, local configuration, installation, and process-execution capabilities. That mismatch weakens host-side policy enforcement and increases the chance that a user or platform treats the skill as simple research automation when it can drive much more sensitive operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

after the user acts, verify completion and continue automatically. Ask again
   only for uncovered material changes or genuinely missing authorization.
   Follow the setup guide's expiry and failure rules; never alter signed plans,
   bypass consent or repeatedly execute an installer with an unknown outcome.

5. Begin research, source transfer, or deliverable generation only after a real
   host capability call, required runtime readiness, and the task's destination

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/jishudb-setup/references/connection-recovery.md (reported line 45)May include surrounding context.

md

| Observation | Check and recovery |
| --- | --- |
| No host entry or wrong effective entry | Locate the configuration actually loaded by the client. Resolve overlapping scopes or overrides before editing. Offer a target choice if unresolved. |
| File contains JishuDB but the host's MCP list does not | This is an unloaded configuration, not yet an OAuth failure. Use the host's supported reload/refresh or configuration-save action and read its list back. If no such action is exposed, return `USER_ACTION_REQUIRED` for a safe user-operated reload/import or restart. Do not ask the user to trust an entry that has not appeared. |
| DNS failure, no route, or connection timeout | Verify the selected host and service reachability from the client. Ask for an updated address or restoration of the required network only when needed. A private IP or timeout does not prove a VPN or subnet cause. |
| Local connection refused | Resolve `desktop-endpoint.json`; check the installed app and listener. Start the existing app within the authorized scope and current user's desktop session. An SSH service-session process is not proof of a working desktop launch. |
| App uninstalled; endpoint or data-location JSON remains | Preserve the files. The endpoint is a port preference; the data bootstrap locates retained data. Use the installation helper's reviewed plan: valid retained data selects an interactive data-preserving reinstall, while an endpoint alone can be reused by a fresh install. Do not delete data or configuration to satisfy fresh-install checks. |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/jishudb-setup/setup.md (reported line 335)May include surrounding context.

md

| Observation | Check and recovery |
| --- | --- |
| No host entry or wrong effective entry | Locate the configuration actually loaded by the client. Resolve overlapping scopes or overrides before editing. Offer a target choice if unresolved. |
| File contains JishuDB but the host's MCP list does not | This is an unloaded configuration, not yet an OAuth failure. Use the host's supported reload/refresh or configuration-save action and read its list back. If no such action is exposed, return `USER_ACTION_REQUIRED` for a safe user-operated reload/import or restart. Do not ask the user to trust an entry that has not appeared. |
| DNS failure, no route, or connection timeout | Verify the selected host and service reachability from the client. Ask for an updated address or restoration of the required network only when needed. A private IP or timeout does not prove a VPN or subnet cause. |
| Local connection refused | Resolve `desktop-endpoint.json`; check the installed app and listener. Start the existing app within the authorized scope and current user's desktop session. An SSH service-session process is not proof of a working desktop launch. |
| App uninstalled; endpoint or data-location JSON remains | Preserve the files. The endpoint is a port preference; the data bootstrap locates retained data. Use the installation helper's reviewed plan: valid retained data selects an interactive data-preserving reinstall, while an endpoint alone can be reused by a fresh install. Do not delete data or configuration to satisfy fresh-install checks. |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/jishudb-setup/references/setup-quickstart.md (reported line 105)May include surrounding context.

md

2. Read `/api/service/capabilities` from that verified endpoint without
   credentials or redirects. For `agentOnboarding.schemaVersion=1`,
   `supported=true` and `route=initial-consent` or `owner-consent`, use native
   OAuth without asking for a management password. Keep advertised owner/device
   verification user-operated. Do not infer a Windows Hello exemption from a
   fresh install; it requires the advertised `windows-fresh-install` method and
   `not-required-for-fresh-install` verification. For other routes, use the full

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/jishudb-setup/references/setup-quickstart.md (reported line 124)May include surrounding context.

md

2. Read `/api/service/capabilities` from that verified endpoint without
   credentials or redirects. For `agentOnboarding.schemaVersion=1`,
   `supported=true` and `route=initial-consent` or `owner-consent`, use native
   OAuth without asking for a management password. Keep advertised owner/device
   verification user-operated. Do not infer a Windows Hello exemption from a
   fresh install; it requires the advertised `windows-fresh-install` method and
   `not-required-for-fresh-install` verification. For other routes, use the full

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/jishudb-setup/setup.md (reported line 149)May include surrounding context.

md

2. Read `/api/service/capabilities` from that verified endpoint without
   credentials or redirects. For `agentOnboarding.schemaVersion=1`,
   `supported=true` and `route=initial-consent` or `owner-consent`, use native
   OAuth without asking for a management password. Keep advertised owner/device
   verification user-operated. Do not infer a Windows Hello exemption from a
   fresh install; it requires the advertised `windows-fresh-install` method and
   `not-required-for-fresh-install` verification. For other routes, use the full

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/jishudb-setup/references/setup-quickstart.md (reported line 121)May include surrounding context.

md

refresh/reload action or an available authorized native UI to load it.
   Verify the named entry and endpoint in the client before mentioning Trust.
   If the list is still empty, finish the supported loading operation yourself
   or report that exact missing capability; never tell the user to trust an
   entry that is not there. A missing tool search
   alone does not prove a configuration cache problem. Do this work yourself
   when the controls are available, without asking the user to write JSON.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs file creation and writes at destinations supplied via command arguments, including artifact downloads and generated JSON output. While the operations are part of the bridge's functionality, this file provides no confirmation prompt and no user-facing notice beyond internal error messages/comments, so the write behavior is not disclosed within the code itself.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos-cnb.cjs (reported line 49)May include surrounding context.

js

if (matches.length !== 1) throw new Error(label + ' must exist exactly once');
  const asset = matches[0];
  assetDigest(asset, label);
  const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id;
  if (asset.url !== expected) throw new Error(label + ' API URL is not canonical');
  return asset;
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos-cnb.cjs (reported line 309)May include surrounding context.

js

if (matches.length !== 1) throw new Error(label + ' must exist exactly once');
  const asset = matches[0];
  assetDigest(asset, label);
  const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id;
  if (asset.url !== expected) throw new Error(label + ' API URL is not canonical');
  return asset;
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 206)May include surrounding context.

sh

if (matches.length !== 1) throw new Error(label + ' must exist exactly once');
  const asset = matches[0];
  assetDigest(asset, label);
  const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id;
  if (asset.url !== expected) throw new Error(label + ' API URL is not canonical');
  return asset;
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 529)May include surrounding context.

sh

if (matches.length !== 1) throw new Error(label + ' must exist exactly once');
  const asset = matches[0];
  assetDigest(asset, label);
  const expected = 'https://api.github.com/repos/x-aijishu/jishudb-desktop-releases/releases/assets/' + asset.id;
  if (asset.url !== expected) throw new Error(label + ' API URL is not canonical');
  return asset;
}

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 934)May include surrounding context.

sh

[[ ! -e "$endpoint_path" ]] || fail "endpoint_conflict" "Desktop endpoint configuration appeared before launch"
  /usr/bin/printf '{\n  "localPort": %d,\n  "schemaVersion": %d\n}\n' "$port" "$ENDPOINT_CONFIG_SCHEMA" > "$endpoint_path" ||
    fail "endpoint_persistence_failed" "Desktop endpoint could not be persisted"
  /bin/chmod 600 "$endpoint_path"
}

run_plan() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 1005)May include surrounding context.

sh

[[ ! -e "$endpoint_path" ]] || fail "endpoint_conflict" "Desktop endpoint configuration appeared before launch"
  /usr/bin/printf '{\n  "localPort": %d,\n  "schemaVersion": %d\n}\n' "$port" "$ENDPOINT_CONFIG_SCHEMA" > "$endpoint_path" ||
    fail "endpoint_persistence_failed" "Desktop endpoint could not be persisted"
  /bin/chmod 600 "$endpoint_path"
}

run_plan() {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 1263)May include surrounding context.

sh

validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle"
  [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app
  local bundle_id bundle_version runtime_binary
  bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist")
  bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist")
  [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan"
  runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/jishudb-setup/scripts/install-macos.sh (reported line 1264)May include surrounding context.

sh

validate_bundle_symlinks "${mount_point}/JishuDB.app" "mounted application bundle"
  [[ -z "$signed_team" ]] || verify_signed_artifact "${mount_point}/JishuDB.app" "$signed_team" app
  local bundle_id bundle_version runtime_binary
  bundle_id=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "${mount_point}/JishuDB.app/Contents/Info.plist")
  bundle_version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${mount_point}/JishuDB.app/Contents/Info.plist")
  [[ "$bundle_id" == "com.aijishu.jishudb" && "$bundle_version" == "$version" ]] || fail "installer_content_invalid" "bundle identity or version does not match the plan"
  runtime_binary="${mount_point}/JishuDB.app/Contents/Resources/runtime/jishudb"