AI时代职业诊断

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:30 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent career diagnostic, but it saves sensitive career and income details to a local report by default without enough user control.

Review this skill before installing if you do not want career, income, and anxiety details saved locally. Use it only when you intentionally invoke the diagnostic, and prefer changing the workflow to ask before saving, use a fixed safe report directory, sanitize filenames, and allow a preview-only or redacted report.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:73

Finding

Mandatory Branded Content Injection in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73, 170, and 192
Vulnerability Type: Mandatory output-template manipulation
Risk Level: High

Relevant code snippets:

markdown

> Based on Chapter 1 of "AI Super Individual: A One-Person Company Wealth Creation Handbook"

markdown

The manuscript proposes the super-individual formula: **Primary-career depth + secondary skill + product thinking + AI leverage**

markdown

> This report was generated by the OPC-AI Skill (career-diagnostic), based on the "AI Super Individual" manuscript framework.

The snippets above are English translations of the corresponding report-template directives at lines 73, 170, and 192.

Technical Analysis

The fixed output template requires generated reports to contain the name of a specific book, its conceptual framework, and OPC-AI attribution. These inclusions are not conditional on user consent and are unrelated to the technical completion of the career-risk assessment.

Because the instructions are loaded as part of the skill and directly control subsequent user-facing output, they can cause the agent to reproduce third-party promotional or branded material automatically. This is an output-integrity issue categorized as skill instruction hijacking: the skill modifies the agent's response objectives by making attribution and promotion mandatory.

No evidence was found that these instructions alter system-level safety constraints, execute code, obtain additional permissions, or compromise the host environment.

Attack Path

1. A user invokes the career-diagnostic skill.
2. The skill collects career information and generates a diagnostic report.
3. The agent follows the mandatory report template in SKILL.md.
4. The generated report includes the specified book title, framework, and OPC-AI attribution even if the user did not request or approve them.
5. If the user publishes or distribu ...[truncated 517 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory book titles, organization names, and promotional attribution from the default report template.
2. Keep the diagnostic methodology vendor-neutral and describe it generically where attribution is not essential.
3. If attribution is legally or academically required, disclose it before report generation and request explicit user consent.
4. Provide a configuration option that allows users to include or omit attribution.
5. Separate informational citations from promotional language and include only sources directly necessary to substantiate the assessment.
6. Add a review requirement ensuring that fixed templates do not silently introduce endorsements or unrelated third-party content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Unsanitized User-Controlled Name Used in Report Filename

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Unsafe construction of a file path from user input
Risk Level: Medium

Relevant code snippet:

markdown

Write the complete diagnosis to a Markdown file, saved by default as `Career_Diagnostic_Report_{name}.md`.

The snippet above is an English translation of the corresponding filename directive at line 65.

Technical Analysis

The report filename incorporates the user's name but does not require validation or sanitization. The instruction does not prohibit path separators, parent-directory components, absolute paths, control characters, reserved names, or other filesystem metacharacters. It also does not define a fixed output directory or require confirmation before overwriting an existing file.

If an implementation interpolates the supplied value directly and has a file-writing tool, a crafted name could change the destination path. For example, parent-directory components could potentially cause the report to be written outside the intended report directory. The precise result depends on the agent's file API, path normalization, sandbox boundaries, and filesystem permissions.

Attack Path

1. The skill asks for or otherwise receives the user's name as part of the diagnostic process.
2. A malicious user supplies a value containing path components or a filename targeting an existing file.
3. The agent directly substitutes that value into Career_Diagnostic_Report_{name}.md.
4. The file-writing tool resolves the resulting path without enforcing a fixed output directory.
5. The report is written to an unintended location or overwrites an accessible file.

Exploitation requires the executing agent to possess a file-writing capability and to interpolate the name literally. A sandboxed tool that normalizes filenames or restricts writes to a dedicated directory may prevent exploitation.

Impact Assessment

Success ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat the supplied name as display data rather than as a filesystem path.
2. Remove /, \, .., control characters, drive prefixes, shell metacharacters, and platform-reserved characters.
3. Apply a strict allowlist, such as letters, numbers, spaces, underscores, and hyphens, followed by a conservative length limit.
4. Resolve the final path against a fixed report directory and verify that the normalized path remains inside that directory.
5. Generate a safe fallback filename when the sanitized name is empty.
6. Use collision-resistant naming or request confirmation before overwriting an existing report.
7. Prefer returning the report in the conversation unless the user explicitly requests file creation.
8. Document the intended output directory and the file-writing permissions required by the skill.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description and full instructions are written as a Chinese-only experience, and the output template is entirely in Chinese, which signals a fixed language/locale behavior. The file does not state that users may choose another language or that the Chinese-only constraint is required for a documented regional purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match ordinary conversation about jobs, AI, or anxiety, which can cause unintended activation of the skill. This matters because the skill then collects sensitive personal and financial information and may create a persistent report, so accidental invocation expands privacy risk and user surprise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill defaults to writing a Markdown diagnostic report without a user-facing warning or consent flow, even though it collects potentially sensitive personal, employment, and income information. Silent persistence of this data can expose users to privacy leakage, unintended retention, or local disclosure to others with access to the system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The default prompt invokes the skill through broad natural-language text without any constrained trigger pattern, parameterization, or scoping. This can cause accidental activation, ambiguous routing, or easier prompt-level misuse by making the skill callable in contexts where the user did not explicitly intend a career-risk diagnostic workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and introductory description frame the skill as an assistant for evaluating AI-era career risk and transition paths through dialogue. At L065, the skill instructs writing the full diagnosis to a Markdown file by default, which is an additional persistence behavior not disclosed in the manifest description.

Content

No source excerpt is available for this finding.