Security audit

daily-decision-making

Security checks for vulnerabilities and agentic risk

Overview

This is a structured decision-journaling skill that may create user-approved local records, with no hidden code, network use, or privileged behavior found.

Install only if you want a Chinese-language structured decision journal. Before creating records, avoid storing secrets, unnecessary identifying details, or private information about other people, and periodically delete or archive records you no longer need.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

Confidence: 96% confidence
Finding: The Chinese trigger phrases are very broad and map to common conversational requests such as 'what should I do' or 'help me analyze', which can cause the skill to activate outside its intended scope. Over-broad activation can divert unrelated conversations into structured record-creation workflows and may prompt users to disclose sensitive career, financial, or relationship information unnecessarily.

Vague Triggers

High

Confidence: 95% confidence
Finding: The English triggers include highly ambiguous phrases like 'should I', 'pros and cons', and 'help me decide', which are common across many harmless everyday contexts. This increases the chance of inappropriate routing and can steer users into an unnecessary data-collection flow where personal preferences, plans, and sensitive circumstances are documented without clear need.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs creating decision record files and filling them with background, goals, research, and comparisons, but it does not warn against storing sensitive personal data. In this context, the data likely includes employment plans, finances, housing, and relationship details, creating privacy and retention risks if recorded by default.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown template is entirely written in Chinese and implicitly requires users to create decision records in that language. Under the policy, a skill should not force a specific language or locale unless it offers an opt-in choice or clearly documents a justified regional constraint.

Static analysis

No suspicious patterns detected.