Security audit

在职副业安全启动

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent side-income planning template with minor usability and privacy cautions, but no evidence of hidden code execution, exfiltration, privilege abuse, or deceptive system behavior.

Before installing, expect this skill to guide a Chinese-language side-income planning conversation and create a local Markdown plan. Review the generated file before sharing it, avoid including sensitive employer or financial details unless needed, and be aware that the template includes book/OPC-AI attribution by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:66
Finding: Hardcoded Promotional Content Injected into Generated Reports## Vulnerability Details **File Location**: `SKILL.md`, lines 66 and 218 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Low **Relevant source excerpts translated into English:** ```markdown > Based on the Chapter 3 framework of "AI Super Individual: The One-Person Company Wealth-Building Handbook" ``` ```markdown > This plan was generated by the OPC-AI Skill (side-income-launcher), based on the "AI Super Individual" manuscript framework. ``` ### Technical Analysis The Skill places book and OPC-AI brand attribution directly inside the prescribed output template. Consequently, whenever the Agent follows the template, it inserts promotional material into the personalized report regardless of whether the user requested attribution. This constitutes output-level instruction manipulation: loading and executing the Skill changes the content of the Agent's final response beyond what is necessary to provide side-income guidance. The behavior is deterministic and embedded in the Skill instructions rather than originating from the user's request. No evidence indicates that these instructions override platform safety controls, execute code, access credentials, retrieve remote content, or alter persistent memory. The manipulation is limited to generated document content. ### Attack Path 1. A user invokes the `side-income-launcher` Skill through a configured trigger or the default prompt. 2. The Agent collects information and generates a side-income plan. 3. The Agent follows the mandatory Markdown output template in `SKILL.md`. 4. The template inserts the hardcoded book reference and OPC-AI attribution. 5. The resulting user-facing document contains unsolicited promotional content. ### Impact Assessment The issue grants no operating-system, filesystem, network, or account privileges. Its scope is limited to influencing generated reports. Potential effects include: - Unrequested branding ...[truncated 376 chars]
Remediation: ## Remediation Suggestions 1. Remove the hardcoded book reference and OPC-AI attribution from the mandatory output template. 2. Keep generated reports focused on information explicitly requested by the user. 3. If attribution is legally or operationally required, disclose that requirement in the Skill description before activation. 4. Make attribution optional and request the user's explicit consent before including it. 5. Separate informational citations from promotional branding and label any retained references accurately. 6. Add a review check ensuring templates do not inject advertisements, endorsements, tracking content, or unrelated third-party messaging.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest description lists trigger phrases such as "第一笔收入" and "能力变现", which are broad topical phrases a user might say in ordinary conversation without intending to invoke this specific skill. The file does not provide exclusion conditions or negative examples to narrow when the skill should activate.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill activates on broad conversational phrases like '我想做副业但不知道怎么开始', which a user might say in general discussion without intending to invoke this skill. This can cause unintended skill routing and unexpected behavior, especially because the skill later directs file output by default.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to write a Markdown file by default without first notifying the user or requesting consent. Unprompted file creation is risky because it causes side effects the user may not expect, can overwrite or clutter local state, and may store sensitive personal data such as names or financial plans in a predictable filename.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The display name and short description are in Chinese, while the default prompt is fixed in English. This imposes inconsistent language behavior without an explicit user opt-in or documented locale policy, which fits the language/locale policy violation category.

Static analysis

No suspicious patterns detected.