Security audit

smart-chatbot-builder（智能聊天机器人构建器，快速创建客服/销售/内部助手聊天机器人，支持知识库、多轮对话、多渠道集成。）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple chatbot-builder guide whose requested access is broadly aligned with importing documents, fetching websites, and writing chatbot configuration, with no evidence of hidden code, persistence, or exfiltration.

Before installing, confirm you want a Chinese-language chatbot-building skill with read, write, web_fetch, and message permissions. Use it with care around customer conversations, internal documents, scraped websites, and analytics data, and define your own consent, retention, and redaction practices.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises website scraping, conversation logging, and user behavior analytics, but provides no notice about consent, data minimization, retention, or handling of potentially sensitive personal data. In a chatbot-builder context, these features can lead to collection of customer messages, internal business data, or scraped third-party content without adequate privacy controls, increasing legal, compliance, and user-trust risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list includes broad generic terms like "chatbot", "AI 助手", and "customer service", which can match many ordinary user requests and cause the skill to activate unintentionally. Because this skill has read, write, web_fetch, and message capabilities, accidental invocation expands its effective access surface and can route unrelated conversations into a higher-privilege workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The metadata presents the skill entirely in Chinese, which can steer the agent toward responding in a specific language without any explicit user opt-in. In a chatbot-building skill, this can cause unintended language locking, reduce usability for other users, and create confusion or misconfiguration in downstream agent behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all user-facing natural language exclusively in Chinese, and it does not state that the skill is China/Chinese-locale specific or offer any language choice. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language description and usage guidance are presented only in Chinese, which can constitute a language policy issue when no user opt-in or alternative language support is offered. The file does not state that the skill is region-specific or otherwise limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The skill description is presented in Chinese at L04, and the trigger set mixes Chinese and English terms, but the manifest does not state whether users can choose their preferred language or locale. That can create a locale-policy concern because the skill appears to assume a specific language presentation without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.