Security audit

Global

Security checks for vulnerabilities and agentic risk

Overview

This is a low-capability markdown-only skill, but its stated purpose does not match the local discovery instructions inside it.

Before installing, expect this skill to behave more like a Chinese-language local place discovery guide than a global commerce or finance brief. The publisher should align the name, description, and examples so users and routing systems know when it should apply.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill manifest claims a purpose around cross-border commerce, global finance, overseas property, and immigration policy, but the body documents local discovery features like queue status, reservations, parking, and navigation. This scope mismatch can cause the agent to route unrelated user requests to the skill, creating deceptive capability signaling and increasing the chance of data misuse or unsafe invocation patterns.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger phrases are highly generic help-style prompts that could match ordinary user requests unrelated to the intended skill domain. Overbroad triggers increase the risk of prompt hijacking at the routing layer, where this skill may be selected for tasks it is not designed to handle, especially given the existing mismatch between declared and documented functionality.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: Natural-language policy issues include forcing a specific language without user opt-in. This file consistently uses Chinese for the description and instructions, but does not indicate that the skill is region-specific or that users may choose another language.

Static analysis

No suspicious patterns detected.