Security audit

Structured Workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese structured-workflow preference with no code execution, data access, network use, persistence, or privilege changes, though its default-on language rules are broad.

Install this only if you want the agent to default to concise Simplified Chinese structured responses across many tasks. Users who need multilingual output, strict custom formats, or user-requested language precedence should avoid it or revise the skill to make Chinese output conditional on explicit preference.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:2
Finding: Global Agent Instruction and Output Hijacking## Vulnerability Details **File Location**: `SKILL.md:2-15`; supporting enforcement in `references/quality-gates.md:11-14` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:2-15`: ```yaml name: structured-workflow description: 默认启用：中文输出、结构化流程、简洁优先。适用于所有任务。 license: MIT --- # 结构化工作流（轻量版）默认规则（始终生效）： 1. 全部使用简体中文。 2. 先结论，后要点；最小充分输出，避免冗余。 3. 执行顺序：构思方案 → 提请审核 → 分解任务。 4. 编码前先调研并澄清疑点。 5. 保持 KISS：优先简单、可维护方案，避免过度工程化。 6. 以事实为准；发现错误时直接指出并修正。 7. 所有输出（包括 Implementation Plan、Task List、Thought）必须使用中文。 ``` `references/quality-gates.md:11-14`: ```markdown 交付前： - 结论是否直接回答用户目标？ - 输出是否中文且精炼？ - 是否避免重复与无关背景？ ``` The source excerpts are reproduced verbatim to preserve audit evidence. In English, they declare the skill enabled by default for every task, mark its rules as always active, require all output to use Simplified Chinese, and extend that requirement to implementation plans, task lists, and thoughts. The quality gate then checks compliance before delivery. ### Technical Analysis The skill is not scoped to a specific user-requested operation. Its metadata states that it applies by default to every task, while its body establishes rules that are always effective. These rules unconditionally control response language, response structure, workflow order, and planning-related output. When the skill is loaded, these broad directives can conflict with the user's current objective or language selection. The explicit inclusion of implementation plans, task lists, and thoughts extends the attempted control beyond an ordinary response-format preference and into the agent's task-processing behavior. The delivery checklist reinforces the hijacking by treating Chinese-language output as a completion requirement. No executable scripts, system commands, dependency installation, network retrieval, credential access, persistent storage, or operating-system privil ...[truncated 1442 chars]
Remediation: ## Remediation Suggestions 1. Remove claims that the skill is enabled by default, applies to every task, or contains rules that are always active. 2. Scope activation to explicit user invocation and to a clearly defined structured-writing use case. 3. Treat language and response structure as optional preferences. Follow the user's requested language and format whenever they conflict with skill defaults. 4. Remove directives targeting thoughts or hidden reasoning. Restrict the skill to observable deliverables such as summaries, plans, and checklists. 5. Replace mandatory wording with conditional guidance, for example: use Simplified Chinese only when requested by the user. 6. Update `references/quality-gates.md` so it verifies compliance with the user's requested language rather than enforcing Chinese. 7. Add an explicit precedence rule stating that system, developer, and current user instructions override every skill preference. 8. Test the revised skill with conflicting language and workflow requests to confirm that loading it cannot override the active task requirements.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The description says the skill is enabled by default and forces Chinese output globally, without checking the user's requested language. This can cause instruction conflicts, degrade usability, and make the agent ignore or mishandle legitimate user requests in other languages.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The rule '全部使用简体中文' mandates Simplified Chinese for all outputs with no fallback or consent mechanism. A hardcoded language restriction can override user intent, interfere with safe operation in multilingual contexts, and create prompt-priority conflicts across unrelated tasks.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: Requiring even categories like 'Implementation Plan, Task List, Thought' to be in Chinese extends the language lock to all output classes and attempts to govern internal/structured response modes universally. That makes the skill more intrusive and increases the chance it will conflict with platform conventions, downstream tooling, or user-required formats.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill declares itself as a default-on behavior for 'all tasks', which gives it an overly broad activation scope and lets it influence unrelated prompts without explicit user consent. Broadly scoped behavioral skills can override user preferences and increase the blast radius of any bad instruction embedded in the skill.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file is written entirely in Chinese and the skill metadata states Chinese output is enabled by default, with no indication of user language selection or opt-in. This can silently override user expectations, reduce transparency, and cause misuse or misunderstanding for users who do not read Chinese, though it is not an exploit in the traditional sense.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Line L13 states that the output should be Chinese and concise, which imposes a specific language requirement. Under the policy, forcing a language without user opt-in or a clearly documented regional justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The skill metadata explicitly states a default of Chinese output, and the workflow content is entirely in Chinese without indicating user choice or a documented locale requirement. This can override user expectations, reduce accessibility, and create opportunities for misunderstanding or misexecution in security-sensitive tasks, though it does not by itself enable direct code execution or data exfiltration.

Static analysis

No suspicious patterns detected.