T01 · Skill Instruction Hijacking
Error
- Location
references/ima_kb_catalog.md:32- Finding
Untrusted dynamically discovered knowledge bases can inject content into the agent context
- Content
View full analysis
- Remediation
View remediation
Security audit
标后履约合规审查Bid Post Award Compliance Reviewer
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for post-award procurement compliance, but it needs Review because it can automatically use newly discovered knowledge bases and optionally store sensitive project/personnel records in plaintext local files.
Install only if you are comfortable using it for Chinese procurement/construction compliance workflows. Before using dynamic IMA sources, restrict knowledge bases to trusted IDs or manually confirm any new source. If saving archives, avoid raw personal identifiers, keep the workspace private and out of sync/source control, and consider separate encrypted storage for sensitive project records.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/archive-schema.md:3- Finding
Sensitive project and personnel records can be persisted in unprotected plaintext JSON files
- Content
View full analysis
.json` file for each project. - Index: `履约合规档案/_index.json` maps all project names to filenames. ``` The schema shown later in the same file includes contract values, document names and summaries, risk findings, personnel roles, actual personnel assignments, qualification conclusions, attendance rates, and subcontractor information. ### Technical Analysis The Skill includes positive safeguards: persistence is optional, explicit consent is required, original documents and direct identity numbers are excluded, and startup scanning is prohibited. However, the resulting commercial and personnel information is still written to ordinary plaintext JSON under the current working directory. The storage specification does not require: - Owner-only filesystem permissions. - Encryption at rest. - A private application-data directory. - Atomic file creation and replacement. - Refusal to follow symbolic links. - Collision-resistant generated filenames. - Strict canonical path validation. - Retention or automatic expiration. - Secure deletion behavior. - Protection from source-control, backup, or workspace synchronization. Replacing only “illegal filename characters” is not a ...[truncated 2385 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文件标题与全文均以中文呈现，并将技能身份与交互说明固定在中文语境中，未见任何允许用户选择输出语言或在非中文场景下切换语言的说明。根据规则，若技能强制特定语言且无用户 opt-in，应视为自然语言层面的策略违规。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list is unusually broad and includes natural-language phrases a user might say in ordinary discussion, such as asking how to sign a contract after award or mentioning compliance review topics. That can cause unintended activation of this high-authority compliance skill, which may override a better-matched general assistant flow and lead users to receive regulated, high-stakes guidance without explicit opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill content is written to operate in Chinese throughout and does not offer user language selection or fallback. In a legal/compliance context, forced language can cause misunderstanding of obligations, evidence, thresholds, or disclaimers, especially for multilingual users reviewing contracts or procurement materials in another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest presents the skill name, authoring, license, and primary description in Chinese, framing the skill as a Chinese-language compliance reviewer without any indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language/locale without opt-in should be flagged unless the constraint is explicitly documented and justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire constraints file is written as mandatory operating guidance in Chinese, with no indication that users may choose another language or that Chinese is required for a justified region-specific workflow. Under the policy, a skill that forces a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file title and operational content are entirely specified in Chinese, framing the skill as a Chinese-language knowledge-base workflow with no indication that users may choose another language. Under the policy, locale or language constraints should either be optional or clearly documented as justified region-specific behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire routing document is written exclusively in Chinese and does not indicate that other languages are supported or that language selection is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file is written entirely in Chinese and presents mandatory operating rules such as '铁律' and user-facing guidance without any indication that language choice is optional. Under the policy scope for natural-language violations, this constitutes a locale/language constraint that is not documented as optional or explicitly justified as a region-specific, opt-in skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template explicitly instructs collection and analysis of sensitive personal data such as face-recognition attendance data, social security records, registration certificate affiliation, and employment status, but it provides no privacy notice, data-minimization rule, lawful-basis check, or handling constraints. In a compliance-review skill, this can normalize over-collection and broad disclosure of personal data in generated reports, creating privacy, regulatory, and insider-misuse risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt explicitly instructs the model to "使用简体中文", which imposes a language choice for all interactions. Under the policy, locale or language constraints should not be forced unless the user is offered a choice or the restriction is clearly justified as region-specific.
- Content