Security audit

AI大佬思想蒸馏框架

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language role-simulation skill with no persistence or credential access, but users should avoid giving it confidential business material unless authorized.

Install only if you want a Chinese-language simulated advisory forum. Use explicit invocations, review generated content as fictional simulation, do not present it as real people’s views, and avoid pasting confidential meeting notes, customer data, unreleased financials, or sensitive strategy unless you have approval.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a full simulation system with multiple operational modes and compliance behaviors. The actual code chunk is a lightweight launcher/template script: it accepts parameters, maps a limited set of participant aliases to persona markdown files, checks whether those files exist, and prints text telling the user what to ask an AI assistant. That is materially different from the declared primary purpose because the code itself does not generate any simulated viewpoints or reports, does not manage the opinion or meeting modes, and does not implement the stated legal safeguards. The limited persona mapping also falls short of the claimed 32-role pool and dynamic expansion features. This is therefore a clear description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill documentation is entirely presented in Chinese and the usage examples implicitly assume Chinese interaction, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill appears to require one language by default without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README's trigger/invocation guidance is broad enough that the skill may activate on generic discussion phrases without clear scoping or explicit user intent. In an agent environment, this can cause unintended invocation, context capture, or role-simulation behavior in situations where the user did not knowingly request this skill, increasing the chance of prompt interference or misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Broad trigger phrases like common requests for discussion or opinions can cause unintended invocation of the skill in unrelated conversations. In this context, accidental activation is more dangerous because the skill encourages persona simulation and may solicit or process strategic business context that the user did not intend to route through this workflow.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly invites users to provide meeting notes and internal background so they can be transformed into role-simulated outputs. In a corporate strategy context, that is dangerous because sensitive meeting content may be re-expressed, summarized, or amplified in generated responses, increasing exposure to unintended recipients and downstream logging or retention systems.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatically activating when the user says only '讨论' is ambiguous and likely to misfire in normal conversation. Because the skill then asks for sensitive topic details and participants, accidental entry into the flow could lead to unnecessary disclosure of internal strategy, meeting context, or proprietary information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The onboarding flow encourages users to supply internal project background and says the system will supplement missing context, which promotes over-collection. In this skill's setting—simulated executive discussion about strategy or projects—that increases the chance of exposing proprietary plans, confidential meeting details, or sensitive business relationships through prompts, generated reports, or external retrieval steps.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is framed as an internal simulation/reporting tool, yet it states it will 'search' for supplementary background when none is provided. That expands the trust boundary and can cause unintended retrieval, mixing external data into sensitive internal discussions, or sending derived prompts to networked tools without the user clearly opting in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains natural-language instructions and role definitions exclusively in Chinese, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing instructions and content exclusively in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file presents all user-facing instructions and disclaimers exclusively in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains natural-language instructions and descriptions exclusively in Chinese, with no indication that users can choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill file presents all user-facing instructions and disclaimers exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file presents its governing disclaimer entirely in Chinese and the overall persona content is also fixed to Chinese, with no indication that users may select another language or that the skill is intentionally limited to a Chinese-language or region-specific context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file presents all operative skill instructions and persona content in Chinese only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file presents all user-facing instructions and content exclusively in Chinese, which can amount to a language-policy constraint if users are not given an explicit choice or opt-in. The file does not state that the skill is region-specific or otherwise justified to require Chinese only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents all user-facing natural-language instructions and disclaimers exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This persona file is entirely written in Chinese and provides no indication that users may choose another language or opt in to this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-facing strings and the generated prompt instruction are entirely in Chinese, which effectively constrains the skill's interaction language. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description, trigger phrases, examples, and interaction flows are all presented in Chinese, and the skill does not state that the user may choose another language. This can amount to a language-policy issue because it effectively assumes a fixed language without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: “当用户提到的角色不在角色池中时，自动触发蒸馏流程” is broad and could activate on casual mentions of people rather than an explicit request to simulate them. The lack of negative examples or confirmation criteria makes the trigger boundary unclear.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file uses only Chinese throughout, including the title and all section content, with no indication that users may choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the policy rule for language/locale constraints, forcing a single language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural-language instructions and descriptions only in Chinese, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file presents all user-facing instructions and persona content exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural-language instructions and persona content solely in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.