在职副业安全启动

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 0.1.0

Overview

This skill provides side-income planning guidance and creates a Markdown plan, with no evidence of code execution, credential access, network activity, or hidden persistence.

Review the generated Markdown before using or sharing it, especially the fixed attribution and any advice about workplace side projects. Confirm your employer's policies and remove promotional attribution if you do not want it in your plan.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:218

Finding

Mandatory Promotional Attribution in Generated User Documents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 218-218; related mandatory attribution also appears at lines 66-66
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet (English translation of the source instruction at line 218):

markdown

> This plan was generated by the OPC-AI Skill (side-income-launcher), based on the framework from the “AI Super Individual” manuscript.

Related Template Content (English translation of line 66):

markdown

> Based on the Chapter 3 framework of “AI Super Individual: A Wealth-Building Handbook for One-Person Companies”

Technical Analysis

The skill defines a mandatory output template that inserts OPC-AI branding and repeated attribution to a named manuscript into each generated plan. This material is not necessary to perform the requested assessment or produce the personalized side-income plan.

Because the attribution is embedded directly in the prescribed template rather than offered as an optional field, loading and following the skill alters the agent's output objective: the agent must distribute third-party branding through its trusted response and generated Markdown artifact. This is a form of instruction-level output hijacking. The behavior does not override safety controls or provide code execution, but it imposes unrelated promotional content on user-facing output.

Attack Path

1. A user invokes the side-income-launcher skill through one of its configured trigger phrases or the default agent prompt.
2. The agent follows the workflow in SKILL.md.
3. The workflow directs the agent to create a Markdown plan using the fixed output template.
4. The template causes the agent to insert the named manuscript attribution and OPC-AI branding.
5. The resulting document is returned or saved as a user-facing artifact, propagating the promotional content through the agent's trusted output channel.

...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory OPC-AI and manuscript attribution from the output template.
2. Keep the generated document focused on information requested by the user and required for the side-income assessment.
3. If attribution is legitimately required, present it as an optional configuration that is disabled by default.
4. Obtain explicit user consent before adding branding or promotional attribution to a user-facing artifact.
5. Clearly distinguish neutral source citations from promotional statements, and include a citation only when it materially supports the generated advice.
6. Review the complete template for other fixed content that is unrelated to the user's requested result.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill metadata and description expose several broad trigger phrases for activation in a general productivity/career context. This can cause the skill to activate in conversations where the user is only mentioning side income conceptually, leading to unintended context switching or inappropriate file-generation behavior, though it does not directly enable code execution or data exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation list includes ambiguous, everyday expressions like '第一笔收入' and '能力变现' without constraints on scope or disambiguation. In a multi-skill environment, this increases the chance of accidental activation and may steer users into career monetization guidance or automatic Markdown output when they intended a different topic, creating reliability and prompt-routing risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file presents the skill name and description in Chinese while hard-coding the default prompt in English. This can constitute a language/locale policy issue because the skill appears to impose a language choice without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.