Security audit

能力结构升级与产品思维训练

Security checks for vulnerabilities and agentic risk

Overview

This skill is a career-planning assistant that creates local reports and uses a bundled template, with no evidence of code execution, exfiltration, or deceptive behavior.

Installers should expect this skill to ask career-assessment questions and create local planning files. Before use, confirm where the report will be saved and avoid putting sensitive personal identifiers in the filename if that matters to you.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The manifest description, trigger phrases, workflow, output template, and generated filename are all specified in Chinese, and there is no indication that users may choose another language. This creates a locale/language constraint without explicit opt-in or a documented region-specific justification.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes broad, everyday phrases such as “产品思维”, “我怎么升级”, and “职业跃迁”, which can match routine conversation and cause the skill to activate unexpectedly. Unintended activation can expose users to unsolicited profiling-style questioning and downstream file-writing behavior they did not explicitly request.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs saving a personalized assessment report to a Markdown file by default, including a filename pattern that may contain the user’s name, without requiring user consent or warning about persistence. This creates a privacy and data-handling risk because sensitive career assessment content and personal identifiers may be written to disk unexpectedly.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill directs copying a bundled document into the output directory without a user-facing notice or consent flow. Even though the copied asset is local and not inherently dangerous, silent file creation can surprise users, clutter workspaces, and combine with personalized output handling in ways that weaken transparency and trust.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The manifest presents the display name and short description in Chinese, while the default prompt is fixed in English. This creates an implicit language/locale constraint without any stated user opt-in or language selection behavior, which matches the policy check for language choice issues.

Static analysis

No suspicious patterns detected.