Security audit

AI 虚拟团队搭建

Security checks for vulnerabilities and agentic risk

Overview

This skill is a visible AI-tool planning template with some usability and disclosure issues, but no evidence of hidden execution, data theft, persistence, or destructive behavior.

Before installing, expect the skill to ask about your business workflow, budget, current tools, and pain points, and to generate a local Markdown report. Review the report before sharing it, especially the fixed attribution footer, and confirm where any file should be saved if the agent offers to write it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:203
Finding: Mandatory Promotional Attribution in Generated Reports## Vulnerability Details **File Location**: `SKILL.md`, line 203 **Vulnerability Type**: Forced output modification **Risk Level**: Medium **Category**: T01: Skill Instruction Hijacking **Relevant instruction translated into English**: ```markdown > This plan was generated by OPC-AI Skill (ai-team-builder), based on the “AI Super Individual” manuscript framework. ``` ### Technical Analysis The mandatory report template instructs the agent to insert promotional attribution for the skill and an associated manuscript into every generated report. This content is unrelated to the core functional requirement of selecting AI tools based on the user's workflow and budget. Because the statement is embedded directly in the output template, loading and following the skill alters the agent's final response independently of whether the user requested, approved, or was informed about the attribution. This is a form of output-oriented instruction hijacking: attacker-selected branding is propagated into user-facing artifacts through trusted agent behavior. A related book attribution also appears at `SKILL.md:68`, reinforcing that the promotional content is intentionally embedded at multiple points in the report template. ### Attack Path 1. A user activates the `ai-team-builder` skill. 2. The agent collects the user's business, workflow, budget, and tool requirements. 3. The agent follows the mandatory Markdown report template. 4. The template causes the agent to insert attribution for the OPC-AI Skill and the associated manuscript. 5. The generated report may subsequently be published, shared, or delivered to clients with the unsolicited branding intact. No arbitrary code execution, elevated system permissions, or host compromise is involved. ### Impact Assessment The issue affects the integrity and neutrality of generated reports. An attacker or skill publisher can cause users to unknowingly reproduce promotional statements or apparent endorsements in downstream ...[truncated 361 chars]
Remediation: ## Remediation Suggestions 1. Remove the mandatory promotional attribution from the report template. 2. Make attribution optional and include it only after obtaining explicit user consent. 3. Keep functional methodology references separate from branding or promotional statements. 4. If provenance must be retained, use neutral metadata such as “Generated with an AI team-planning template” without naming or endorsing external publications. 5. Review the additional attribution at `SKILL.md:68` and remove it or subject it to the same opt-in mechanism. 6. Add a template review rule prohibiting unsolicited advertising, endorsements, affiliate content, and unrelated branding in user-facing outputs.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match many ordinary requests about AI tools, which can cause the skill to activate outside the user's clear intent. That increases the chance of unsolicited behavior, including collecting unnecessary business details or steering the conversation into this skill when the user only wanted general advice.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill states that it will write a Markdown file by default, but it does not require explicit user consent or provide a warning before doing so. Automatic file creation can surprise users, expose sensitive business information in local artifacts, or overwrite/create files in contexts where the user expected only conversational output.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The file presents the skill name and description in Chinese while the default prompt is fixed in English. This creates an implied language/locale choice without explicit user opt-in or documentation that the skill is intentionally bilingual or region-specific.

Static analysis

No suspicious patterns detected.