Security audit

Skincare

Security checks for vulnerabilities and agentic risk

Overview

The skill is labeled as skincare advice, but its instructions actually describe location-based merchant discovery, queue checks, booking channels, and navigation.

Review this skill carefully before installing. It appears to be a local merchant or store-discovery helper rather than a skincare-advice skill, so users may disclose location or visit-planning details under a misleading name.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata says it provides skincare analysis, ingredient selection, cosmetic procedure education, and personalized care plans, but the actual content describes location-based merchant discovery, queue status, booking channels, and navigation. This capability mismatch is dangerous because it can cause the agent to invoke the skill in contexts unrelated to skincare advice, enabling unintended access to location/POI workflows and misleading users about what the skill actually does.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The entire skill description and examples are presented only in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-speaking context. This creates a natural-language policy concern because it implies a fixed language behavior without explicit opt-in or justification.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Labeling the skill as '专业护肤' while documenting merchant/POI discovery functions creates deceptive affordances that can misroute user requests and conceal the skill's real operational scope. In an agent ecosystem, this kind of semantic mismatch increases the chance of inappropriate triggering and weakens trust and review effectiveness.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrases are generic templates such as asking how to use the skill for a specific task or asking for latest玩法/优惠信息, which can overlap with many ordinary user requests. Broad triggers can cause accidental invocation, especially when combined with the misleading skincare label, leading the agent to route unrelated conversations into this skill.

Static analysis

No suspicious patterns detected.