Security audit

Styling

Security checks for vulnerabilities and agentic risk

Overview

This is a small Chinese-language styling and local beauty-service guidance skill with some broad wording, but no executable code, persistence, credential handling, or hidden high-impact behavior.

Before installing, understand that this skill is not just outfit and makeup advice; it may guide the agent toward local beauty-service recommendations using location, popularity, queue, booking, parking, and promotion information. Only share location or appointment details when you intend to use those features.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest says the skill provides styling advice and consultant selection, but the body documents geolocation-based venue discovery, queue status, parking, navigation, and community-sourced business intelligence. This scope drift is dangerous because it can cause the agent or user to invoke the skill for capabilities that were not transparently declared, increasing the chance of unauthorized data use, misleading routing, or policy bypass via an understated manifest.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The sample trigger phrases are extremely generic, such as asking how to use the skill for a 'specific scenario task' or asking about 'core features,' which could match ordinary conversation unrelated to explicit skill invocation. Overbroad triggers are risky because they increase accidental activation and may route users into a skill with undeclared local-discovery behavior without sufficiently informed intent.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation further expands the skill into promotions, 'latest玩法', and community popularity updates, which goes beyond a styling-advice assistant into dynamic local recommendations and commercial discovery. This matters because broadening the operational scope without clear disclosure can enable unintended plugin activation, user confusion about what data is being used, and abuse of a benign-looking skill as a gateway to location- and commerce-related actions.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The natural-language content of the skill is entirely in Chinese, and the file does not indicate that this language restriction is optional, user-selected, or justified by a region-specific purpose. This can violate language or locale policy where skills should not force a specific language without user opt-in.

Static analysis

No suspicious patterns detected.