Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向职业发展、商业验证和研究报告生成的综合顾问型技能；而实际代码仅实现了一个非常具体的 KANO 需求排序工具。它既没有体现《AI超级个体》相关流程，也没有执行 OPC 能力诊断、资料检索、市场/案例/政策研究或报告生成。代码的主要目的与声明的核心用途明显不一致，因此属于实质性描述与行为不匹配。
- Content
Security audit
AI超级个体实战助手
Security checks for vulnerabilities and agentic risk
Overview
This looks like a legitimate Chinese career and one-person-company advisory skill, but it repeatedly directs agents to create or overwrite local files containing personal or business details by default.
Review this skill before installing if you work in a shared or synced workspace. Ask the agent to show reports in chat first and get your confirmation before saving or overwriting files, especially for career, income, customer, pricing, or business-plan details. Do not provide site passwords, cookies, tokens, or captcha values; the skill’s own download rules say to stop at login or membership barriers.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (111)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
L3 的自然语言描述完全以中文规定技能用途，且文件整体默认以中文交互，没有看到为用户提供语言选择、按用户语言偏好响应，或对中文限定作出明确合规说明。这会构成语言/locale 强制要求的自然语言政策问题，尤其当技能可能面向多语言用户时。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include very generic terms such as '商业模式' and '帮我建模', which can match ordinary conversation and cause unintended activation of the skill. In an agent environment, accidental invocation can lead to unnecessary data collection, workflow switching, or downstream tool use the user did not clearly request.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill directs the agent to read internal files and use external links/research resources, but it does not declare any explicit tool scope such as allowed tools or permission boundaries. That creates an authorization ambiguity: a host agent may permit broader file or network access than users expect, increasing the risk of unintended data exposure or outbound requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file consistently specifies the skill in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill metadata and default prompt are entirely in Chinese without indicating that the user may choose another language. This can lead to unwanted language forcing, user confusion, and misalignment of outputs, especially when invoked for users operating in other languages or mixed-language environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The default prompt activates the skill with a very generic phrase about helping with a user's current situation and next steps, which can overlap with many ordinary coaching, planning, or productivity requests. This increases the chance of unintended invocation, causing the agent to apply this skill in contexts the user did not explicitly select and potentially exposing misleading guidance or unnecessary tool usage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file is entirely written as a Chinese-only workflow and the default output filename and template are also Chinese, with no indication that the user may choose another language. This can violate language or locale policy when a skill implicitly forces one language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation list includes generic phrases such as "产品思维", "我怎么升级", and "职业跃迁", which can easily appear in normal discussion without the user intending to invoke this specific skill. The file also does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow says to save the generated report as a Markdown file by default without user-facing warning or consent. Silent persistence is dangerous because it can store sensitive career information, names, or assessments on disk without the user's knowledge, especially in shared or managed environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow directs the agent to save a Markdown file to disk by default, which introduces filesystem side effects beyond purely conversational guidance. Even if the content is benign, silent file creation can violate user expectations, create data-handling/privacy issues, and expand the skill's effective permissions surface.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs copying a bundled document asset into an output directory, which is another filesystem modification not clearly disclosed in the skill description. Unannounced file copying increases the risk of unexpected persistence, user confusion, and misuse of agent file access in environments where writing artifacts has security or compliance implications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to activate on generic requests like '用什么AI工具' or 'AI工具推荐', which may invoke this skill outside its intended context. This can cause inappropriate skill routing and irrelevant recommendations, especially in systems where skills auto-activate without explicit user confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow instructs saving a generated report to a Markdown file by default without explicit user consent. Automatic file creation can expose sensitive business details, create unwanted artifacts in the workspace, and be abused in agentic environments where writing files has side effects or interacts with downstream automation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest uses a Chinese-only display name ("AI 虚拟团队搭建") while the rest of the skill metadata is in English, with no indication that the skill is region-specific or that users can choose their preferred language. This creates a language/locale policy concern because it imposes a specific language presentation without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language description is entirely in Chinese and includes Chinese trigger phrases, indicating the skill is designed to operate in a specific language. There is no accompanying instruction offering a language choice or explaining a justified region-specific requirement, which conflicts with the policy against forcing a locale without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest presents the skill name and description in Chinese while the default prompt is fixed in English. This creates an implicit language constraint/mismatch without offering the user a language or locale choice, which fits the language-policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script returns user-facing status messages only in Chinese, such as "待验证" and "可优先产品化", with no option to select another language. This is a natural-language policy concern because it forces a locale/language choice on all users without opt-in or documented regional scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow directs the agent to persist a full personalized career-diagnostic report to a local Markdown file, even though the skill is framed as a conversational assessment tool. This creates an unnecessary data-persistence path for sensitive personal and employment information without clear user consent, retention limits, or need-to-store justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs automatic creation of a personalized report file without warning or confirmation, despite collecting potentially sensitive data such as job role, income structure, skills, and anxieties. Silent persistence increases privacy risk, may surprise users, and can expose personal data through local files, syncing, backups, or shared environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match ordinary conversation about examples or case studies, increasing the chance the skill activates when the user did not intend to invoke it. Overbroad activation can cause unnecessary data collection, unintended tool use, and execution of the skill’s file-reading/writing workflow in unrelated contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow specifies saving an analysis report to a Markdown file without any user-facing warning or consent step. Because the report is built from collected user background, challenges, and business plans, this can silently persist potentially sensitive personal or commercial information to storage.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow instructs the agent to write a Markdown report file as a default behavior, which extends beyond simple case matching/analysis into persistent file modification. Unprompted file creation can surprise users, leave sensitive profile details on disk, and create opportunities for unintended data retention or downstream misuse if later tools/processes consume the generated file.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill is used for requests like “帮我规划内容”, “内容矩阵”, and “发什么内容”, all of which are broad phrases that may appear in ordinary conversation outside a clear request to invoke this specific skill. The file does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation phrases are broad everyday requests like '帮我规划内容' and '发什么内容', which can cause unintended invocation when a user is speaking generally rather than explicitly selecting this skill. In a multi-skill agent, that can route user context into this module unexpectedly, producing unauthorized file-generation behavior or inappropriate recommendations based on the wrong workflow.
- Content