Security audit

德胧舆情情报综合工具箱

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed public-opinion monitoring workflow, but it includes hard-coded Feishu delivery, persistent scheduled agent runs, web-search override metadata, and mutable third-party installation instructions that need review before use.

Install only after replacing the Feishu recipient with an authorized destination, removing or tightly scoping the web_search override, pinning all BettaFish package/Git/container dependencies, and making scheduled monitoring an explicit opt-in with clear disable and expiry controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:355
Finding: Hard-Coded Feishu Recipient Enables Unintended Report Disclosure
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:355
Finding: Persistent Scheduled Monitoring Tasks Survive the Initial Skill Run
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:12
Finding: Skill Requests Override Authority Over the Standard Web Search Tool
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:126
Finding: Unpinned Packages, Repository Dependencies, and Mutable Container Images
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:214
Finding: Fixed Promotional Branding Is Injected into Generated Report Output
Content: View full analysis
🔴 超级热点 [标题]**\n\n[内容]"}, {"tag": "hr"}, {"tag": "markdown", "content": "**🟠 投诉数据**\n\n• [投诉1]\n• [投诉2]"}, {"tag": "hr"}, {"tag": "markdown", "content": "**🟡 风险分析**\n\n[AI分析内容]"}, {"tag": "note", "content": "🦞 德胧AI龙虾军团 | v2.0", "quoteless": false} ] } ``` ### Technical Analysis The supplied output template appends a fixed promotional attribution to generated Feishu cards. This content is unrelated to the substantive monitoring result and is controlled by the skill author rather than the report recipient. The behavior does not alter system safety settings or execute code. However, when agents are instructed to use this template as the standard output format, it causes skill-controlled content to be included in otherwise functional reports. This represents a limited form of output-goal manipulation. ### Attack Path 1. The agent accepts the supplied Feishu card template. 2. The agent inserts monitoring and analysis results into the placeholders. 3. The fixed note remains in every generated card. 4. Recipients receive the author-selected promotional message as part of normal report output. ### Impact Assessment No additional system privileges are obtained. The impact is limited to report integrity, presentation, attribution, and possible organizational-policy violations. Recipients may incorrectly assume that the branding is approved by the deploying organization or is required for the monitoring service. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad terms such as '情报', '监控', and '风险分析' that are common in many unrelated conversations, increasing the chance of accidental skill activation. In a skill that performs external information collection and monitoring, unintended activation can lead to unnecessary data retrieval, misleading outputs, or privacy-sensitive queries being run in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill description is entirely Chinese and presents the tool as China-specific by default, while later instructions also prescribe output formatting and timezone choices tied to that locale. There is no statement offering the user a language choice or making the locale restriction explicit as an opt-in policy.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says the skill '整合 miaoda搜索 + BettaFish开源舆情引擎 + 飞书精美卡片' and lists them as three core capabilities. However, later sections state BettaFish is '待安装' and provide only installation/usage guidance, while Feishu output is described as a JSON template and sending notes rather than implemented executable behavior in this skill file. This creates a meaningful mismatch between claimed integrated functionality and what is actually present/documented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listed trigger words include generic terms such as “舆情”, “情报”, “监控”, and “风险分析”, which can appear in many normal user requests outside this skill’s intended scope. The description does not provide narrowing conditions, explicit activation boundaries, or negative examples to prevent unintended invocation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description presents AI risk analysis and mitigation-plan generation as an existing core function. In the body, the corresponding section consists of a workflow description, a prompt template, and example outputs, but no concrete runnable implementation or tool definition is shown. That means the documented artifact overstates the degree of actual built-in capability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill instructs users to pull a Docker image using the mutable latest tag, which makes the deployed artifact non-deterministic and vulnerable to upstream image changes or supply-chain compromise. If the publisher account or registry content is altered, users may run unexpected code with the trust implied by this skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: All user-facing instructions, labels, and trigger phrases are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The section defines trigger words like “风险分析” and “防控预案” without clarifying what context, data type, or domain must be present before the skill should activate. Because these are broad phrases, they could match unrelated requests for general analysis or planning.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The stated purpose is collecting public web intelligence, generating Feishu cards, and performing risk analysis. Instructions for git clone, docker pull/run, and openclaw gateway restart introduce system administration and environment modification capabilities that are not part of that end-user analytical purpose. While presented as guidance, these capabilities are not justified by the manifest's declared operational scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The template requires output in Feishu Markdown format, which is a locale/platform-specific presentation requirement, but the document does not indicate that users may choose another language or output style. This creates a fixed default rather than a documented opt-in or justified regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.