other
Warning
- Location
SKILL.md:347- Finding
Unbounded Collection of Sensitive Internal Communications
- Content
View full analysis
- Remediation
View remediation
Security audit
德胧大佬蒸馏系统
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent executive-simulation purpose, but it tells agents to collect and archive private/internal communications into reusable executive profiles without clear authorization, minimization, or retention controls.
Review before installing. Use only in an approved internal environment, restrict Feishu access to explicitly approved documents and channels, prohibit private or one-to-one chats and colleague assessments by default, require authorization from the organization or data owner, and add review, redaction, retention, and deletion controls before archiving any role profiles.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The source-material design explicitly includes private chats, colleague assessments, and decision records as inputs for role distillation. These are classic high-risk inputs for profiling because they combine informal communications and subjective evaluations, increasing the chance of privacy violations, bias, reputational harm, and misuse of internal confidential information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs collection of executives' message histories and decision records from Feishu to build persistent role cards. That is sensitive internal data processing aimed at individual behavioral profiling, which can expose confidential communications, create unauthorized dossiers, and amplify harms if the generated profiles are reused or leaked.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad, common internal expressions like '模拟讨论' and '快速蒸馏', which increases the chance of accidental activation during ordinary conversations. In this skill, accidental activation is more dangerous because it can generate simulated executive viewpoints and potentially invoke sensitive internal context without deliberate user intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill claims not to handle sensitive personnel matters, but later enables generating new executive role cards from historical internal communications and decision traces for named individuals. This inconsistency weakens safety boundaries and can mislead operators into believing the system avoids sensitive profiling when it in fact facilitates it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The automatic matching section defines scenario-based activation conditions that are highly ambiguous and map routine operational statements directly to executive personas. This can cause the skill to infer intent and route ordinary business discussion into sensitive profiling or simulation workflows without clear user consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The nuwa-delao submodule extends a role-simulation skill into collection and distillation of executives' Feishu messages, documents, and decision records. That is a material expansion of scope into profiling and surveillance-like data processing, with no documented consent, minimization, or access-control constraints, creating a real risk of privacy and confidentiality abuse.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The skill specification, trigger examples, warnings, and output templates are all presented as Chinese-only behavior, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the regional constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This markdown file presents all instructions and usage cues exclusively in Chinese, and nowhere indicates that the user can opt into another language or that the skill is intentionally restricted to a Chinese-language context.
- Content
Static analysis
No suspicious patterns detected.