Security audit

大佬思想蒸馏框架 dalao v3.5

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed persona-simulation framework with no evidence of hidden data access or persistence, but it should be used carefully because it simulates real people.

Install only if you intentionally want a private, clearly labeled AI viewpoint-simulation aid. Do not use it to create public statements, interviews, news copy, or attributed quotes for real people, and do not feed it private chats, meetings, or company materials unless you have authorization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a full-featured simulation framework with multiple operating modes, a large pre-distilled persona pool, and several compliance/validation mechanisms. The supplied code chunk does not realize those behaviors. It only parses two arguments, maps a limited set of participant identifiers to persona file paths, checks file existence, and prints example text for the user to paste into an AI assistant. There is no evidence of actual discussion generation, opinion mode, meeting mode, validation logic, filtering, source classification, or output-format enforcement. The code's primary behavior is a lightweight launcher/template generator, which is materially narrower than the declared framework.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Overly broad trigger phrases can cause the skill to activate during ordinary conversation, unexpectedly steering the assistant into persona-simulation behavior. In this skill, that is more sensitive because it simulates real named individuals and may generate attributed views without a deliberate user request, increasing the risk of impersonation-like or misleading output.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The automatic activation rule for characters outside the predefined pool is ambiguous and may trigger role-simulation for arbitrary named individuals based on casual mention alone. Given the skill’s purpose of generating realistic viewpoints for real people, this broad activation increases the risk of unauthorized impersonation, reputational harm, and misuse in sensitive contexts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says all outputs must be labeled with 【观点模拟：XXX】 and that reports must pass a "决策链检测" before generation. This script only echoes a prompt template for a discussion and never enforces either requirement, so its implemented behavior is materially weaker than the described framework controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description advertises a full interaction system with discussion mode, opinion mode, meeting mode, 33 pre-distilled roles, source grading, validation, and quote filtering. This file only maps a small subset of personas and prints a manual instruction string, which does not match the breadth of functionality claimed by the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.