Vague Triggers
Medium
- Confidence
- 96% confidence
- Finding
- 该描述写明“当 Agent 需要执行某个分析但不清楚具体流程时调用”，这是一个宽泛的内部状态触发条件，而不是明确、可验证的调用边界。文中也没有列出具体触发短语、适用范围限制或反例，容易让技能在泛化的“需要分析流程指导”场景下被过度调用。
Security audit
GROMACS Protein Analysis
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Markdown guide for GROMACS protein analysis workflows and does not add hidden execution, credential access, persistence, or unrelated authority.
Install only if you want Chinese-language guidance for GROMACS protein simulation analysis. Review generated shell commands before running them because they create or append local analysis files, but no hidden high-impact behavior was found.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Natural-Language Policy Violations
Medium
- Confidence
- 98% confidence
- Finding
- 文件中的名称和整段描述均以中文固定呈现，未说明可根据用户语言偏好切换，也未提供语言选择或光学限制的正当性说明。根据语言/区域政策，技能若隐含强制单一语言输出而无用户选择，应视为自然语言策略问题。
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
- Suspicious Unicode normalization or mixed-script content
Natural-Language Policy Violations
Medium
- Confidence
- 88% confidence
- Finding
- This markdown file presents all instructions and explanations exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language/locale policy requirements when users are not given opt-in or an explicit justification for the restriction.
Natural-Language Policy Violations
Medium
- Confidence
- 96% confidence
- Finding
- The entire skill description and instructions are written in Chinese, with no indication that the language is selectable or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The entire skill documentation is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- 该技能文档全文以中文编写，未说明这是面向特定中文用户群体的区域性技能，也未提供用户语言选择或替代说明。按自然语言策略要求，强制单一语言而无用户选择可能构成语言/locale 策略违规。
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- This markdown file presents all user-facing instructions and explanations exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Natural-Language Policy Violations
Low
- Confidence
- 95% confidence
- Finding
- The entire skill documentation is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is required for a region-specific purpose. Under the policy, a fixed language choice without user opt-in can be a natural-language locale violation.
Natural-Language Policy Violations
Low
- Confidence
- 96% confidence
- Finding
- 该 markdown 文件的全部说明、步骤和问答均以中文呈现，没有任何提示表明用户可选择其他语言或该技能仅面向特定中文使用场景。根据规则，未获用户选择或无明确合理说明的语言/locale 强制属于自然语言策略问题。
Natural-Language Policy Violations
Low
- Confidence
- 95% confidence
- Finding
- The entire skill content is written in Chinese and does not indicate that other languages are supported or that the user can choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Static analysis
No suspicious patterns detected.