任务收尾器

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:07 AM UTC
• Version: 1.0.2

Overview

This is a simple workflow skill that makes agents report goals, progress, and completion evidence; its broad activation may be annoying but the reviewed artifact does not show hidden code, data theft, persistence, or destructive behavior.

Install this only if you want agents to be stricter about progress updates and completion evidence. Review generated evidence before sharing it, and avoid logging secrets, credentials, or sensitive task details in progress artifacts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: 任务收尾器
version: 1.0.2
description: 强制任务收尾与证据提交。确保每个任务都有明确的目标、进度、下一步和完成证据。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: 整个技能描述与输出模板均以中文固定呈现，且未说明用户可选择其他语言，也未将中文约束解释为特定地区或合规要求。根据语言/区域策略，强制单一语言而无用户选择可能构成自然语言政策违规。

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill declares very broad self-trigger conditions such as applying to 'any multi-step task,' after interruptions, during handoffs, and when the user asks not to only provide a plan. In an agent environment, this can cause the skill to activate in many ordinary contexts without explicit user consent, potentially overriding normal workflow behavior and pushing the agent toward autonomous execution and artifact generation when that was not intended.

Vague Triggers

Low

• Confidence: 85% confidence
• Finding: The trigger phrase '不要只给计划，直接执行' is common and ambiguous, and can appear in many benign user requests. Without additional constraints, the skill may interpret ordinary requests for action as consent to enforce its own workflow, including evidence-production and autonomous next steps, leading to unintended behavior changes.

Static analysis

No suspicious patterns detected.