Virtual User Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent local user-research purpose, but it mishandles sensitive local research data and includes risky deployment guidance that users should review before installing.

Install only after fixing or accepting the data-handling risks: remove key printing, disable plaintext sample exports by default, require explicit import files instead of scanning Downloads, pin dependencies, and do not use the systemd or public API deployment examples without authentication, localhost binding, least-privilege service configuration, and a reviewed unit file.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: src/encrypt.py:94

Finding

Encryption Key Disclosed Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: src/encrypt.py:94-103
Vulnerability Type: Cryptographic secret disclosure
Risk Level: High

Vulnerable Code

python

if __name__ == "__main__":
    manager = EncryptManager()
    key = manager.load_or_create_key()
    print(f"密钥：{key.decode()}")

    # 测试加密解密
    test_data = "这是测试数据".encode('utf-8')
    encrypted = manager.encrypt_data(test_data)
    print(f"加密后：{encrypted}")

This executable path is invoked by the documented initialization workflow in README.md:21-25 and DEPLOYMENT.md:53-54. It is also called by run.sh:36-42 when no key exists:

bash

if [ ! -f "$HOME/.virtual_user/.key" ]; then
    echo "生成新密钥..."
    python3 src/encrypt.py
else
    echo "✅ 密钥已存在"
fi

Technical Analysis

The script prints the complete Fernet key immediately after loading or creating it. This key protects the entire scenario database. Standard output may be retained in CI/CD logs, terminal recordings, agent execution transcripts, deployment logs, or centralized logging systems.

Fernet encryption remains cryptographically sound only while the key is secret. Printing the key defeats the confidentiality expected from encrypting scenario_library.json.enc.

The Base64 operation used by encrypt_data is not itself an exfiltration mechanism, and no network transmission sink was identified. The vulnerability is the explicit disclosure of the underlying encryption key.

Attack Path

1. A user follows the documented initialization procedure or starts the Skill through run.sh.
2. If the key does not exist, src/encrypt.py creates it under ~/.virtual_user/.key.
3. The same key is printed to standard output.
4. The output is captured in a deployment log, CI log, terminal transcript, or agent history.
5. An attacker who can access that output and the encrypted scenario file reconstructs the Fernet cipher and decrypts all records.

Impact Assessment

An attacker who obtains the disclosed key an ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every statement that prints, logs, serializes, or returns the encryption key.
2. Move encryption demonstrations into isolated unit tests that use ephemeral, test-only keys.
3. Change the initialization path so it reports only whether key creation succeeded.
4. Review CI, deployment, shell, and agent logs for historical key exposure.
5. Rotate any key that may already have been printed, then re-encrypt the database with the new key.
6. Store production keys in an operating-system keyring or managed secret store where practical.
7. Add automated tests that fail if log output contains the key or other cryptographic material.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/prepare_data.py:201

Finding

Sensitive Research Records Written to Plaintext Sample Files

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/prepare_data.py:201-204
• scripts/merge_scenario_library.py:575-578

Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

The standard data-preparation workflow writes the first five imported records without encryption:

python

# 6. 保存示例数据（可选，用于测试）
sample_file = output_dir / "sample_scenarios.json"
with open(sample_file, 'w', encoding='utf-8') as f:
    json.dump(scenarios[:5], f, ensure_ascii=False, indent=2)
print(f"✅ 已保存示例数据（前 5 条）：{sample_file}")

The full-library merge workflow repeats the behavior:

python

# 8. 保存示例数据（前 5 条）
sample_file = OUTPUT_DIR / "sample_scenarios.json"
with open(sample_file, 'w', encoding='utf-8') as f:
    json.dump(unique_scenarios[:5], f, ensure_ascii=False, indent=2)
print(f"✅ 已保存示例数据（前 5 条）：{sample_file}")

Technical Analysis

Both workflows create an encrypted scenario library and then separately write records into data/sample_scenarios.json as readable JSON.

The standard preparation workflow performs no PII anonymization before creating this sample. The merge workflow only replaces selected company names and names matching a narrow 姓名[...] pattern. Other identifiers, free-form personal details, and sensitive behavioral information may remain.

This behavior contradicts the documented expectation that the scenario library is encrypted at rest and that original data is not exposed.

Attack Path

1. A user supplies an Excel file containing real user-research records.
2. prepare_data.py or merge_scenario_library.py converts the data and creates the encrypted library.
3. The workflow also creates data/sample_scenarios.json.
4. The sample contains the first five processed records in plaintext.
5. The file is read by another local user, included in a backup, copied with the project, or accidentally committed to source control.
6. Personal or commercially sensitive research information becomes e ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove plaintext sample generation from the default processing workflow.
2. Use synthetic, non-production records for demonstrations and tests.
3. If sample generation is necessary, require an explicit command-line opt-in and display a clear privacy warning.
4. Apply structured PII detection and redaction rather than relying on selected keyword replacements.
5. Write any approved sample with restrictive owner-only permissions and an explicit retention period.
6. Add data/sample_scenarios.json to .gitignore and repository secret/data scanning rules.
7. Search repository history and distributed artifacts for previously generated sample files and remove them.
8. Update documentation so it accurately identifies every plaintext output.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/merge_scenario_library.py:245

Finding

Maintenance Scripts Read Every Excel File in the User Downloads Directory

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/merge_scenario_library.py:42,245-274
• scripts/incremental_merge.py:30,277-289
• The same directory-selection pattern is also present in scripts/quick_merge.py.

Vulnerability Type: Excessive local file access and unintended data ingestion
Risk Level: High

Vulnerable Code

python

DOWNLOADS_DIR = Path.home() / "Downloads"

python

def load_all_excel_files() -> list:
    """加载所有 Excel 文件并合并"""
    print("\n" + "=" * 60)
    print("📂 步骤 1: 加载所有 Excel 文件")
    print("=" * 60)

    excel_files = [f for f in DOWNLOADS_DIR.iterdir()
                   if f.suffix == '.xlsx' and not f.name.startswith('.')]

    excel_files = [f for f in excel_files if f.name not in EXCLUDE_FILES]

    print(f"📁 找到 {len(excel_files)} 个 Excel 文件（已排除 {len(EXCLUDE_FILES)} 个重复文件）")

    all_scenarios = []
    file_stats = []

    for i, file_path in enumerate(sorted(excel_files), 1):
        try:
            print(f"\n[{i}/{len(excel_files)}] 读取：{file_path.name}")

            xl_file = pd.ExcelFile(file_path)
            sheet_name = xl_file.sheet_names[0]
            df = pd.read_excel(file_path, sheet_name=sheet_name)

            scenarios = df.to_dict('records')

            for s in scenarios:
                s['_source_file'] = file_path.name

            all_scenarios.extend(scenarios)

The incremental workflow also selects all spreadsheets unless an optional filename filter is supplied:

python

excel_files = [f for f in DOWNLOADS_DIR.iterdir()
               if f.suffix == '.xlsx' and not f.name.startswith('.')]
excel_files = [f for f in excel_files if f.name not in EXCLUDE_FILES]

if len(sys.argv) > 1:
    target_name = sys.argv[1]
    excel_files = [f for f in excel_files if target_name in f.name]
    print(f"🎯 只处理包含 '{target_name}' 的文件：{len(excel_files)} 个")

Technical Analysis

The scripts access a broad personal directory rather than requiring explicit files or a dedicated imp ...[truncated 1729 chars]

Remediation

View remediation

Remediation Suggestions

1. Require one or more explicit input file paths.
2. Alternatively, use a dedicated import directory created specifically for scenario-library data.
3. Reject files outside the approved import directory after resolving symbolic links and canonical paths.
4. Validate required column names before loading row data.
5. Display the exact file list and require confirmation before batch processing.
6. Do not use substring matching as the primary security control for file selection.
7. Add a dry-run mode that reports candidate files without opening them.
8. Avoid retaining source filenames where they may reveal sensitive project or customer information.
9. Document the exact filesystem scope required by every maintenance script.

T08 · Insecure Dependencies

Warning

• Location: run.sh:24

Finding

Launcher Automatically Installs Unpinned Dependencies

Content

View full analysis

Vulnerability Details

File Locations:

• run.sh:24-32
• requirements.txt:4-14

Vulnerability Type: Unsafe dependency resolution and installation
Risk Level: Medium

Vulnerable Code

bash

# 检查依赖
echo ""
echo "📦 检查依赖..."
if [ ! -f "venv/bin/activate" ]; then
    echo "创建虚拟环境..."
    python3 -m venv venv
fi

source venv/bin/activate
pip install -q -r requirements.txt
echo "✅ 依赖安装完成"

text

sentence-transformers>=2.2.0
numpy>=1.21.0
scikit-learn>=1.0.0
cryptography>=3.4.0
pandas>=1.3.0

Technical Analysis

Every invocation of run.sh executes pip install. Dependencies are specified only with open-ended minimum versions. There is no lockfile, upper bound, package hash verification, or reviewed transitive dependency set.

Consequently, the code installed during one run may differ from the code previously audited. Python packages and their transitive dependencies can execute installation-time and import-time code under the invoking user’s account.

The dependency names are recognizable, and no suspicious custom package index or obvious typosquatted package was identified. The risk comes from mutable, unverified supply-chain resolution rather than a confirmed malicious package.

Attack Path

1. A direct or transitive dependency publishes a compromised release that still satisfies the minimum version.
2. The user executes run.sh.
3. pip resolves the newer, unreviewed package.
4. The package is installed into the virtual environment.
5. Malicious installation-time or import-time code executes with the user’s privileges.
6. The compromised dependency can read project data, the local Fernet key, or other files accessible to that account.

Impact Assessment

A compromised dependency runs with the privileges of the user launching the Skill. It may access ~/.virtual_user/.key, decrypt the scenario database, alter project files, or access other user-readable resources.

The launcher does not use sudo, so this issue do ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate and maintain an audited dependency lockfile with exact versions.
2. Require cryptographic hashes for downloaded distributions.
3. Separate dependency installation from normal Skill execution.
4. Do not run pip install automatically on every launch.
5. Review and lock transitive dependencies, not only direct dependencies.
6. Use a trusted package index and disable unexpected extra indexes.
7. Add dependency vulnerability scanning and controlled update review.
8. Consider building a reproducible signed environment or container image.

T06 · System Persistence

Warning

• Location: DEPLOYMENT.md:211

Finding

Deployment Guide Enables a Privileged Persistent System Service

Content

View full analysis

Vulnerability Details

File Location: DEPLOYMENT.md:211-217
Vulnerability Type: System-level persistence exceeding the CLI workflow’s minimum privileges
Risk Level: Medium

Vulnerable Code

bash

# 在服务器上克隆代码
git clone <your-repo-url>
cd virtual_user_skill

# 安装依赖
./run.sh

# 设置为系统服务（可选）
sudo cp virtual_user.service /etc/systemd/system/
sudo systemctl enable virtual_user
sudo systemctl start virtual_user

Technical Analysis

The deployment guide instructs users to copy a service unit into the system service directory and enable it across reboots. This creates cross-session persistence and requires root privileges.

The declared core functionality is a local command-line scenario-search and interview workflow. A system-wide persistent service is not required for that workflow. The instruction is marked optional and resembles a production deployment method rather than a covert backdoor, but it still exceeds the minimum privilege required by the Skill.

The referenced virtual_user.service file is absent from the audited project. Its executable command, service user, environment, restart policy, filesystem permissions, and hardening settings therefore cannot be reviewed.

Attack Path

1. A user obtains or creates a file named virtual_user.service.
2. The user follows the guide and copies it into /etc/systemd/system/ with sudo.
3. systemctl enable virtual_user registers it for execution across reboots.
4. systemctl start virtual_user immediately executes the configured service command.
5. If the unit file is attacker-controlled or improperly configured, it can execute arbitrary persistent code with the identity and privileges declared in that unit.

Impact Assessment

The persistence survives the individual Skill run and can survive system restarts. If the service defaults to root or explicitly specifies a privileged identity, arbitrary commands may obtain system-wide access.

The audited repository does not include ...[truncated 184 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove system service registration from the default deployment path unless persistent operation is essential.
2. Include the complete service unit in the repository so it can be audited.
3. Run the service under a dedicated unprivileged account rather than root.
4. Prefer a user-level systemd service where system-wide privileges are unnecessary.
5. Apply systemd hardening such as NoNewPrivileges=true, PrivateTmp=true, ProtectSystem=strict, ProtectHome=true, and narrowly scoped ReadWritePaths.
6. Use absolute executable paths and a controlled working directory.
7. Do not allow the service unit or executable path to be writable by unprivileged users.
8. Document safe disablement and removal commands.
9. Require explicit informed confirmation before establishing cross-reboot persistence.

T09 · Insecure Skill Coding Practices

Warning

• Location: DEPLOYMENT.md:247

Finding

Unauthenticated API Example Exposes the Skill on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: DEPLOYMENT.md:247-268
Vulnerability Type: Insecure network service configuration
Risk Level: Medium

Vulnerable Code

python

from flask import Flask, request, jsonify
from src import VirtualUserSkill

app = Flask(__name__)
skill = VirtualUserSkill()

@app.route('/api/interview', methods=['POST'])
def interview():
    data = request.json
    question = data.get('question')

    result = skill.run(question, auto_select=True)

    return jsonify(result)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

Technical Analysis

The deployment example binds the Flask development server to every network interface and exposes an endpoint without authentication or authorization. It does not validate content type, question type, input length, request size, or invocation rate.

The returned result includes selected user profiles, conversation summaries, reports, and conversation history. These values derive from the locally decrypted research database. An accessible network client can therefore query the local data indirectly.

Model inference and scenario search are also resource-intensive. Without rate limiting, remote clients can repeatedly invoke them and consume CPU and memory.

Attack Path

1. An operator deploys the example on a workstation or server.
2. Flask listens on 0.0.0.0:5000.
3. A remote client reaches the port through the local network, cloud security group, port forwarding, or an exposed host.
4. The client sends arbitrary POST requests to /api/interview.
5. The service processes queries without verifying the caller.
6. Responses expose generated profiles and scenario-derived content.
7. Repeated or oversized requests consume application resources and may cause service degradation.

Impact Assessment

A reachable unauthenticated user can invoke the Skill and retrieve scenario-derived research information. The exact disclosure depends on search results and g ...[truncated 217 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind to 127.0.0.1 by default rather than 0.0.0.0.
2. Require strong authentication and enforce authorization for access to research datasets.
3. Place the application behind a production WSGI server and TLS-enabled reverse proxy.
4. Validate request content type and require a non-empty bounded string for question.
5. Configure maximum request sizes and execution timeouts.
6. Add per-user and per-address rate limits.
7. Return only the minimum fields required by clients instead of the complete internal result object.
8. Add audit logging that excludes research records and cryptographic secrets.
9. Use network firewall rules to restrict the endpoint to approved clients.
10. Do not present the Flask development server as a production deployment pattern.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (80)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DEPLOYMENT.md (reported line 323)May include surrounding context.

pip install -r requirements.txt --upgrade

重新生成密钥（如需要）

rm ~/.virtual_user/.key python3 src/encrypt.py

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared scope includes large-scale scenario retrieval, deep interview simulation, and product evaluation, but the implementation reportedly only covers limited user-type generation and selection management. This mismatch is a security concern because overclaimed capability can mask under-reviewed code paths and lead users to trust outputs or permissions that are not justified by the actual implementation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script documentation states that the scenario library will be stored in encrypted form, but the code later writes sample_scenarios.json in plaintext. This creates a misleading security boundary: operators may believe all exported data is protected while a readable subset of processed records remains exposed on disk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The code writes the first five processed scenario records to sample_scenarios.json in plaintext, even though the workflow emphasizes encrypted storage. Processed records still contain rich scenario text and user background details, so this file can leak sensitive business or personal information to any local user, backup process, or downstream tool that accesses the filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The sample export stores raw scenario records in plaintext without redaction or warning. Given this skill processes a large library of real user research scenarios, the exported fields may include personal background details, behavioral context, needs, and pain points, making local disclosure materially harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Printing a generated or loaded encryption key to stdout is a direct secret disclosure. Even if this is labeled as test code, such code is often executed locally, in packaging checks, or in CI, where stdout may be retained and accessible long after execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire deployment guide and all usage examples are presented only in Chinese, including required command arguments such as example user questions and model defaults oriented to Chinese usage. There is no indication that users may choose another language or that the locale restriction is mandatory for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 190)May include surrounding context.

bash

# 修复权限
chmod 600 ~/.virtual_user/.key

问题 4：数据文件不存在

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 215)May include surrounding context.

./run.sh

设置为系统服务（可选）

sudo cp virtual_user.service /etc/systemd/system/ sudo systemctl enable virtual_user sudo systemctl start virtual_user

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 216)May include surrounding context.

./run.sh

设置为系统服务（可选）

sudo cp virtual_user.service /etc/systemd/system/ sudo systemctl enable virtual_user sudo systemctl start virtual_user

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 217)May include surrounding context.

./run.sh

设置为系统服务（可选）

sudo cp virtual_user.service /etc/systemd/system/ sudo systemctl enable virtual_user sudo systemctl start virtual_user

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · DEPLOYMENT.md (reported line 216)May include surrounding context.

设置为系统服务（可选）

sudo cp virtual_user.service /etc/systemd/system/ sudo systemctl enable virtual_user sudo systemctl start virtual_user

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill metadata explicitly describes a local, non-API skill, but the deployment guide adds an API service mode that changes the trust boundary and exposes functionality over the network. This mismatch can cause operators to deploy the skill in a riskier configuration than expected, especially when handling sensitive scenario-library data and generated interview outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The API deployment instructions create a public network listener without warning that requests may be unauthenticated and that processed content may include sensitive local scenario-library data. In this skill context, the local-data design makes accidental network exposure more dangerous because users may assume the tool never leaves the host boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security guidance suggests API service mode provides higher protection, yet the example API runs on 0.0.0.0 with no authentication, authorization, or TLS. This can expose the skill to unauthorized remote access, allowing arbitrary requests against local data-backed functionality and potentially leaking sensitive scenario data or outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill documentation is presented in Chinese, including headings, setup steps, and usage examples, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy where user-facing materials should not force a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to run a local Python script and reveals additional capabilities involving shell, file access, and environment interaction, but it does not declare any tool scope or permissions boundaries. This creates an unnecessary trust gap: an operator or orchestrator cannot easily constrain what the skill may access, increasing the risk of unintended local file reads, writes, or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L003 将“虚拟用户”“生成用户画像”“基于场景的用户测评”等自然语言表述直接作为触发条件，其中部分短语较宽泛，可能覆盖普通产品讨论或研究交流场景。该描述未提供排除条件、负例或更明确的触发范围，因此容易造成非预期调用。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill is designed around real research scenarios and background information, yet the documentation provides only limited privacy assurances and does not clearly warn users about data sensitivity, residual re-identification risk, or the limitations of generated personas. In a skill handling local datasets and potentially decrypted content, weak privacy notice and consent language materially increase the risk of inappropriate disclosure or overtrust in generated outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.