Security audit

Startup Tools

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a startup guidance toolkit, but it also ships an under-documented local note/log utility users should know about.

Install only if you are comfortable with a startup guidance skill that includes China-oriented templates and a separate generic local note/log command. Avoid putting secrets, private fundraising details, credentials, or confidential business data into the add command unless you intend that text to be stored on disk.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill metadata and documentation present this as a startup-focused toolkit, but the analyzed behavior reportedly includes generic note/log storage, local history persistence, and utility commands unrelated to the declared purpose. That mismatch is security-relevant because users and calling agents may grant trust, invoke the skill, or expose data based on the stated business function, while the actual behavior introduces undeclared data handling and broader capabilities.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest promises capabilities like创业清单, 公司注册, MVP规划, 融资准备, 法律合规, and 增长策略, which imply domain-specific startup assistance. In contrast, the code exposes only generic commands such as add, list, search, export, and info over a local log file, with no startup-specific logic or workflows.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This shell script is a code file, so natural-language strings embedded in it are in scope for policy review. The help text and command outputs prominently use Chinese and bilingual labels, but the skill does not give users any opt-in or language-selection mechanism, which can violate language/locale policy when a specific language is effectively imposed by default.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The heading 'When User Asks for Startup Help' describes a very broad trigger scope that overlaps with common conversational requests. It does not define specific trigger phrases, boundaries, or exclusion cases, so the skill could be invoked for many generic startup-related questions unintentionally.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The file includes a dedicated 'China-specific Considerations' section with Chinese legal and business context, but it does not state that this locale-specific guidance is optional or only for users operating in China. Presenting region-specific regulatory guidance by default can violate language/locale policy when the user has not opted into that locale.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The comment and help output present the skill as a generic multi-purpose utility rather than a startup-specific toolkit. This actively diverges from the declared intent in the manifest, suggesting the code/documentation belongs to a broader-purpose utility than the advertised skill.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The script logs command arguments to a persistent history file without clearly disclosing that behavior. If users pass sensitive business notes, names, tokens, or other confidential data as arguments, those values will be retained on disk and may be exposed to other local users, backups, or support tooling.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The add command stores arbitrary user-supplied content in a persistent file without warning the user in help output or documentation. In the context of a startup toolkit, users may enter sensitive operational, fundraising, or compliance notes, creating unintended local data retention risk.

Static analysis

No suspicious patterns detected.