Security audit

qcstory

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese QCstory coaching skill that guides users through a disclosed improvement workflow and does not request tools, credentials, persistence, or system access.

Install this if you want a Chinese-language QCstory improvement coach. Be aware that it may activate for broad work-improvement requests and will guide the conversation through a rigid nine-step process; avoid entering confidential business details unless you are comfortable sharing them with the agent running the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill is configured to activate on 'any trigger word', which creates an overly broad invocation surface and can cause accidental activation in unrelated conversations. That increases the chance the agent interrupts other tasks, captures unintended user context, or steers the interaction into this workflow without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description and interaction design are written to operate in Chinese and position the coach as a specific Chinese QCstory workflow, but the file does not state that this language constraint is optional or region-specific. This can amount to a locale/language policy issue because the skill appears to force a specific language experience without user opt-in.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on generic requests about solving work problems, not just explicit QCstory usage. This can cause unintended routing of users into a rigid, step-by-step workflow that may not match their intent, leading to prompt hijacking of normal conversations, user confusion, and inappropriate collection of structured business-process details.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The instruction defines the assistant as a '华与华 QCstory' coach and requires a specific Chinese conversational style, and line 7 further mandates spoken language. There is no opt-in or language choice offered, so this constitutes a natural-language locale policy issue under the rule.

Static analysis

No suspicious patterns detected.