Security audit

AI超级个体实战助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language career and one-person-business planning assistant with local report generation, not evidence of malware or hidden exfiltration.

Install only if you want a Chinese-language planning assistant that may create local Markdown reports and template copies containing career, income, pricing, customer, and business-plan details. Before running report or review workflows, ask the agent to show the destination path and avoid overwriting existing files unless you approve.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (95)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose says this is a broad 'AI超级个体' assistant with 21 modules, while the analyzed behavior reportedly corresponds to a different KANO prioritization tool. This kind of description-behavior mismatch is dangerous because users and policy systems may grant trust, data, or permissions based on the stated business purpose, while the actual functionality operates outside those expectations.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill instructs the agent to read additional module files via relative paths, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where file-reading behavior is implied by prompt instructions rather than constrained by manifest policy, increasing the chance of unintended access to local skill files or adjacent content if path handling is loose elsewhere in the system.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file consistently presents the skill name, description, and operating instructions only in Chinese. Under the policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The display name, description, and default prompt are all written in Chinese, which indicates the skill is effectively constrained to a specific language. There is no visible opt-in, language selection mechanism, or documentation that this is intentionally limited to Chinese-speaking users for a justified regional purpose.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The default prompt invokes the skill through a broad, generic phrase without clear boundaries on when or how the skill should be activated. In an agent environment, underspecified invocation text can cause over-broad routing or unintended use of this skill for loosely related requests, which may expose users to inappropriate automation or prompt-confusion behavior.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad, natural-language phrases such as “我怎么升级” and “职业跃迁”, which can cause the skill to activate on loosely related user requests without clear intent. This is dangerous because it can unexpectedly steer conversations into this workflow and combine with later file-writing behavior, reducing user control over tool invocation and side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow instructs the agent to write a Markdown report to a default filename without first warning the user or obtaining explicit consent. This is risky because it creates filesystem side effects automatically, may expose personal data such as the user’s name in filenames, and can overwrite or clutter user files unexpectedly.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow directs the agent to copy a bundled document into the output directory and modify the copy, again without a user-facing notice or consent. This is dangerous because it performs non-obvious filesystem changes, may create unexpected artifacts, and could overwrite files or leak workflow behavior into user storage without clear authorization.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases include broad everyday expressions like asking what AI tools to use, which can cause the skill to activate unintentionally in unrelated contexts. Over-broad activation increases the chance of collecting unnecessary business information or initiating downstream actions such as generating persistent output when the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow says the plan should be written to a Markdown file and saved by default, but it does not require clear notice or user approval before persisting data. Because the report contains business profile details, tools in use, pain points, budget, and workflow information, silent storage creates a privacy and data-retention risk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The workflow directs the skill to write and save a Markdown file by default, which introduces a side effect beyond giving recommendations. Even if the content is benign, automatic file creation can persist user business details locally without explicit consent and expands the skill’s operational scope from advisory to data handling.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description includes broad trigger phrases such as '我能卖什么', '把技能变产品', and '能力变现方向', which are common user expressions and can cause the skill to be invoked in contexts where the user did not explicitly request this specific workflow. Unintended invocation can steer conversations toward this module's framing and outputs, reducing user control and potentially causing incorrect or overly prescriptive business advice to be applied out of context.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The script returns user-facing status messages exclusively in Chinese, such as "待验证" and "可优先产品化", with no option to select another language or locale. This can violate a language/locale policy when the skill is used in broader contexts without explicit user opt-in or documented justification.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The workflow explicitly instructs the agent to write a personalized Markdown report file, which expands behavior from conversational guidance into filesystem side effects. Because the report includes user-specific career, income, and anxiety details, silent file creation can create unintended persistence of sensitive personal data and exceed user expectations or granted permissions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill directs the agent to save a personalized report to disk without any warning, consent, or review step. This is dangerous because it persists sensitive profile data such as job role, income structure, and personal concerns, increasing privacy and data-handling risk if the environment is shared, synced, or later accessed by others.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The skill description and all interaction patterns are fixed in Chinese, including the trigger words and output examples, with no indication that users may choose another language. This creates a natural-language policy concern because the skill appears to force a specific language without opt-in or an explicit region- or audience-based justification.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases include very generic requests such as asking to analyze cases or find a suitable case, which can cause the skill to activate in situations the user did not clearly intend. This creates scope-confusion risk: the agent may begin reading internal reference data and steering the conversation into this workflow unexpectedly, reducing user control and potentially causing unintended file/tool use.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow directs the agent to write a Markdown report to disk by default without first notifying the user or obtaining consent. Unprompted file creation can leak sensitive user-provided career or business details into persistent storage, create unexpected artifacts, and combine dangerously with broad triggers to perform side effects the user did not request.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest's default prompt says "Use $case-explorer to match my situation..." but does not define when the skill should or should not be invoked beyond a general request to match a situation. In a manifest file, this lacks specificity and negative constraints, which can make activation boundaries unclear.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This JSON reference file presents all case titles, chapters, scenarios, and takeaways exclusively in Chinese, with no indication of language choice or opt-in. Under the stated policy, a skill artifact that imposes a single language without offering user choice can constitute a natural-language policy violation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases include generic terms such as “内容策略” and “怎么运营账号”, which can cause the skill to activate in situations where the user did not explicitly intend to invoke this module. Over-broad activation can route unrelated conversations into this workflow, increasing the chance of inappropriate actions or disclosure of user context to the wrong skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow instructs the agent to write a Markdown file by default without first obtaining explicit user confirmation. Any automatic file write is a side effect that can create unintended persistence of user data, overwrite existing files, or surprise the user in environments where filesystem actions are sensitive.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The manifest presents the skill name and description in Chinese while the default prompt is fixed in English. This imposes a language choice inconsistency without any opt-in or documented locale justification, which can violate language/locale policy expectations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The description lists trigger examples such as “我在哪一级”, “技能阶段”, and “AI 替代风险与升级”, which are generic phrases that could appear in everyday coaching or career discussions. The file does not provide negative examples or explicit activation boundaries to distinguish when this skill should or should not be used.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file presents the skill name and description in Chinese while the default prompt is fixed in English. This creates a natural-language locale inconsistency that can effectively force a language choice without user opt-in or justification, which matches the language/locale policy concern.

Static analysis

No suspicious patterns detected.