Security audit

brand-slogan

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only Chinese marketing-copy skill with disclosed web-search and uploaded-file use, and no hidden code or persistence.

Before installing, understand that if brand details are missing the skill may perform web searches, and if you upload PPT/PDF brand materials it may extract brand information from them. Avoid using confidential launch plans, private customer data, or unreleased brand documents unless you are comfortable with the agent processing them for slogan generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to perform WebSearch automatically when brand data is incomplete, and elsewhere claims support for uploaded PPT/PDF parsing. Those capabilities expand data access beyond simple proverb generation and are not tightly scoped or justified, increasing the chance of unintended retrieval, processing of untrusted content, or privacy issues from external/file-derived data.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: For a skill whose purpose is generating marketing proverbs from provided inputs, automatically searching the web on insufficient input is unnecessary privilege expansion. This can expose user queries to third parties, introduce prompt/data poisoning from search results, and cause the model to fabricate or rely on untrusted external brand information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill performs automatic external data access when inputs are incomplete but provides no user warning or consent step. That creates a transparency and privacy problem because user-provided brand context or queries may be transmitted to external services without the user's awareness.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The instruction mandates output in Chinese colloquial language only, which is a language-policy constraint expressed in natural language. The file does not indicate user opt-in for this requirement or explain why the skill must be limited to Chinese.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill is written to operate in Chinese only and does not offer a user language choice or fallback, which can override user expectations and reduce transparency about how outputs will be produced. While not a direct code-execution risk, it creates accessibility and usability issues and can contribute to unsafe misunderstandings if users cannot accurately review generated content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to use WebSearch when user-provided brand information is incomplete, which expands behavior beyond the declared local three-step proverb-generation flow. This can cause unexpected external data access, privacy leakage of user-supplied brand context, and nondeterministic behavior that users and integrators did not consent to.

Static analysis

No suspicious patterns detected.