Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
文档整体以中文定义技能行为与输出预期，但未说明是否支持按用户语言偏好切换，也未提供语言选择或 opt-in 机制。按规则，这类默认强制特定语言的自然语言约束可能构成语言/locale 策略问题。
- Content
Security audit
Nova Perspective Router
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local keyword-based router that suggests expert-perspective skills, with no evidence of hidden network access, credential use, persistence, or destructive behavior.
Install this only if you want Nova to route complex analysis through named expert-perspective skills. Review which companion perspective skills are installed and consider tightening triggers so ordinary questions are not unnecessarily reframed through personas.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes broad automatic routing for 'complex, multi-domain, professional-depth' tasks without clear exclusion criteria. This can cause over-triggering on ordinary requests, unintentionally changing model behavior and increasing exposure to downstream skills that may be less appropriate or less safe.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases include very common and ambiguous expressions like '这个战略怎么样' and '商业分析', which are likely to appear in many normal conversations. Broad phrase matching can route benign requests into expert-persona flows unnecessarily, causing misclassification and expanding the skill attack surface.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'when to use this skill' section says to use it whenever specialized analysis is involved or Nova is unsure which perspective to call, but it does not define when not to use it. This ambiguity encourages default routing in uncertain situations, which can amplify errors and propagate unsuitable expert framing into responses.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The skill explicitly reveals internal workspace paths and names of installed skills, which aids enumeration of the local skill environment. Even though the examples are static, exposing concrete filesystem layout and component names gives an attacker useful reconnaissance for targeting downstream prompt-injection or capability-abuse attempts.
- Content
python # Naval open("/workspace/skills/naval-perspective/SKILL.md").read() # Elon Musk open("/workspace/skills/elon-musk-perspective/SKILL.md").read()
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
This line continues the disclosure of internal skill names and filesystem layout, making it easier to map the available skill ecosystem. Enumeration lowers attacker effort by identifying follow-on targets and how they are loaded.
- Content
md open("/workspace/skills/naval-perspective/SKILL.md").read() # Elon Musk open("/workspace/skills/elon-musk-perspective/SKILL.md").read() # Charlie Munger open("/workspace/skills/munger-perspective/SKILL.md").read()
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The example exposes another concrete skill path, further confirming predictable storage conventions for companion skills. In the context of a router whose job is to dispatch into other skills, this makes reconnaissance more actionable because attackers can infer likely downstream components and prompt targets.
- Content
open("/workspace/skills/elon-musk-perspective/SKILL.md").read()
Charlie Munger
open("/workspace/skills/munger-perspective/SKILL.md").read()
text ## 集成规则
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description is broad enough to trigger on many loosely related tasks, which can cause the agent to invoke this router outside clearly bounded contexts. Because the skill then steers downstream selection of expert personas and follow-on SKILL.md files, over-broad routing increases the chance of unnecessary delegation, prompt-scope expansion, and manipulation of later reasoning steps.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is written in Chinese and presents the skill behavior in that locale without indicating language negotiation or user preference handling. This can lead to mismatched language responses or hidden behavior for users operating in other languages, reducing transparency and potentially causing incorrect invocation or interpretation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese for the release notes. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code’s user-facing description and operational instructions are presented primarily in Chinese, and later output strings continue that assumption. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.