OPC 商业模式画布

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward business-modeling report helper with some privacy and trigger-scope cautions, but no evidence of malicious behavior.

Install only if you are comfortable sharing business-planning details with the agent and saving them in a local Markdown file. Prefer invoking it explicitly with "OPC建模" or "opc-modeler", review the generated report before sharing it, and choose a private save path if exporting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:56

Finding

Mandatory Promotional Attribution Injected into Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:56 and SKILL.md:199
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Relevant code snippets translated into English:

SKILL.md:56

markdown

> Based on the Chapter 4 framework of “AI Super Individual: One-Person Company Wealth Manual”

SKILL.md:199

markdown

> This report was generated by OPC-AI Skill (opc-modeler), based on the “AI Super Individual” manuscript framework.

Technical Analysis

The fixed output template directs the agent to add book and Skill branding to generated business-model reports. These attribution statements are unrelated to the substantive analysis requested by the user and are included without an instruction to obtain informed user consent.

Because the attribution is embedded in the Skill's prescribed report template, an agent following the Skill will reproduce it in interactive responses and exported Markdown files. This constitutes limited output-level instruction hijacking: the Skill modifies the final deliverable to carry third-party promotional or provenance claims rather than limiting its instructions to the requested business-modeling function.

This finding does not involve code execution, credential access, privilege escalation, network communication, persistence, or modification of safety controls.

Attack Path

1. A user activates the opc-modeler Skill and provides business-planning information.
2. The agent follows the mandatory report template in SKILL.md.
3. The template inserts the referenced book attribution near the beginning of the report.
4. The template inserts additional Skill and manuscript branding at the end of the report.
5. If the user requests file export, the unsolicited attribution is preserved in the generated Markdown document.

Impact Assessment

The issue affects the integrity and neutrality of generated reports. Users or downstream rec ...[truncated 409 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory book, manuscript, and Skill branding from the default report template.
2. Keep generated reports focused on user-requested business-model content.
3. If attribution is legitimately required, clearly disclose it before report generation and obtain explicit user consent.
4. Provide an opt-in parameter such as include_attribution, defaulting to false.
5. Ensure exported files preserve the user's attribution preference.
6. Review future template changes for unrelated promotional text, provenance claims, or instructions that alter user-facing output beyond the Skill's stated function.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase "帮我建模" is also overly generic and can match many unrelated requests, making accidental invocation plausible. In this skill, accidental activation matters because the workflow immediately begins eliciting structured personal and business information from the user.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "商业模式" is extremely broad and likely to activate during ordinary discussion unrelated to this specific skill. That can cause unintended routing into the skill, leading to unnecessary collection of business-sensitive information or unexpected file generation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructions and invocation phrases are entirely Chinese and present the assistant's behavior as fixed, with no indication that users may choose another language. This can violate language-choice policy when a skill implicitly constrains interaction to a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to write a Markdown file containing potentially sensitive business data, income targets, resources, and contacts, but provides no privacy notice, retention warning, or explicit consent flow beyond path confirmation. This creates risk of storing confidential user information locally or in shared environments without the user understanding the exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest provides a single default prompt for invoking the skill, but it does not define when this skill should or should not activate, nor does it provide any negative examples or scope constraints. For a manifest file, this can make invocation boundaries ambiguous because the trigger intent is described only at a high level.

Content

No source excerpt is available for this finding.