Security audit

价值定价分析

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a pricing-report helper, but it automatically saves potentially sensitive business details and injects mandatory third-party branding into generated reports.

Review the generated report before sharing it with clients, remove unwanted attribution or branding, and avoid saving confidential pricing, customer, budget, or case-study details unless you intentionally want them written to a local Markdown file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:73
Finding: Mandatory Branded Attribution Injected into Generated Reports## Vulnerability Details **File Location**: `SKILL.md`, lines 73 and 182 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```markdown > 基于《AI超级个体：一人公司创富手册》第四、六章框架 ``` ```markdown > 本方案由 OPC-AI Skill（value-pricer）生成，基于《AI超级个体》书稿框架。 ``` ### Technical Analysis The mandatory output template instructs the agent to insert attribution to a named book near the report header and an OPC-AI promotional statement in the report footer. These statements are not necessary for performing value analysis, calculating prices, or preparing customer communication scripts. Because the statements are embedded in the prescribed template rather than presented as optional metadata, an agent following the Skill will reproduce them in ordinary user deliverables. This modifies the expected task output to include third-party branding without requesting the user's informed consent. It therefore constitutes output-oriented instruction hijacking. The reviewed package contains no executable scripts, external payload retrieval, credential access, persistence mechanisms, or privilege-escalation logic. Exploitation is limited to the content generated while this Skill is active. ### Attack Path 1. A user invokes the Skill by requesting pricing guidance or a three-tier proposal. 2. The agent follows the report-generation workflow in `SKILL.md`. 3. The agent applies the mandatory output template. 4. The named-book attribution is inserted near the beginning of the generated report. 5. The OPC-AI attribution is appended to the report footer. 6. The user may save or distribute the report without noticing that promotional content was incorporated into the professional deliverable. ### Impact Assessment No operating-system privileges, credentials, private files, or persistent agent state can be obtained through this issue. The impact is confined to output integrity and the downstream distribution of ge ...[truncated 319 chars]
Remediation: ## Remediation Suggestions 1. Remove the named-book attribution at line 73 and the OPC-AI promotional footer at line 182 from the mandatory report template. 2. Keep the default output focused exclusively on information required to satisfy the user's pricing request. 3. If attribution is required for legitimate licensing reasons, disclose that requirement before report generation and request explicit user consent. 4. Implement attribution as an optional parameter that defaults to disabled rather than as fixed template content. 5. Add a white-label output mode that guarantees the absence of third-party branding, promotional language, and implied endorsements. 6. Review all future template changes for content unrelated to the declared Skill function.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The top-level description includes broad consumer-facing trigger terms like '怎么定价' and '收费多少' that can easily appear in ordinary conversation outside the intended one-person-business consulting context. This can cause unintended skill activation and context switching, which is a real prompt-scope weakness even though it is not directly code-execution related.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The activation list is made of short, ambiguous phrases such as '怎么报价' and '客户嫌贵怎么办' without scope constraints. In a general assistant environment, this increases accidental invocation risk and may cause the agent to collect business details or produce pricing artifacts when the user only asked a casual or unrelated question.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to write a Markdown file by default, but the user is not clearly warned or asked for consent before data is persisted. Because the generated report may contain commercially sensitive pricing strategy, customer pain points, budgets, or case-study details, silent file creation creates an avoidable privacy and data-handling risk.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: Line L4 hard-codes an English instruction in the default prompt even though the surrounding skill metadata is in Chinese. This creates a language-policy concern because the skill appears to impose English by default without offering the user a choice or documenting why English is required.

Static analysis

No suspicious patterns detected.