Security audit

ask-ai1.2

Security checks for vulnerabilities and agentic risk

Overview

This skill asks outside AI services for help, but it can automatically send task details through logged-in browser sessions and keep records without clear per-use confirmation.

Install only if you are comfortable with the agent automatically using third-party AI sites under persisted logged-in accounts and sending task details to them. Avoid using it with private code, credentials, personal data, business-sensitive material, or regulated information unless you add a clear confirmation, redaction, and memory-retention policy first.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger conditions are broad enough to activate during ordinary uncertainty, user disagreement, or routine failures, which can cause the agent to automatically escalate tasks to external AI services without clear necessity or explicit user approval. In this skill's context, that increases the chance of oversharing sensitive prompts, internal context, or user data to third parties and makes unintended autonomous behavior more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README promotes persistent cookie storage across sessions but does not document security boundaries, storage protections, session lifecycle controls, or user-facing privacy risks. Persisted authentication material increases the blast radius of local compromise, profile reuse, or unintended access by later sessions using the same browser profile.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill is explicitly designed to forward user problem context to external AI providers such as 豆包、千问、Kimi, and DeepSeek, yet the README does not clearly disclose third-party data sharing, consent requirements, or limits on what may be transmitted. Because the skill auto-triggers when the agent is uncertain, sensitive task details may be sent externally without the user's informed approval, making this particularly dangerous in an agent setting.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is designed to auto-trigger in a very large set of normal assistance scenarios, including uncertainty, user disagreement, or any task requiring manual steps. In context, this broad activation is dangerous because it can cause unsolicited transmission of user content to third-party AI services without a clear, case-specific consent step.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly requires use of a persistent browser profile tied to the user's logged-in accounts, which exposes session data, chat history, and account context to automated actions. This is particularly risky because the workflow normalizes operating inside authenticated third-party services without prominent user warning, scoped consent, or safeguards against cross-account data exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instruction to save model responses and execution traces to memory creates retention of potentially sensitive user-derived data without a clear disclosure, retention policy, or minimization rule. Because these traces may contain troubleshooting details, account context, or copied content from third-party models, this increases privacy and secondary exposure risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill mandates immediate invocation and automatic model switching without asking for user confirmation, even though it sends user problem details to external AI providers. That removes an essential consent boundary and can disclose sensitive information to multiple third parties in sequence, magnifying exposure.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Requiring preservation of third-party model replies and execution history in memory encourages broad retention of content that may include sensitive user context, provider output, and operational metadata. In this skill, that retention is more dangerous because it is paired with automatic external sharing and use of authenticated sessions, increasing the amount and sensitivity of data captured.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The prompt template directs the agent to forward the user's goals, attempted solutions, and blockers to external AI providers by default. This is risky because users may not realize their troubleshooting context can contain private, proprietary, or account-related information, and the skill lacks a required review/redaction step before transmission.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The later instruction to save model replies and execution logs reinforces persistent retention of user-derived and third-party content without clear consent boundaries. In combination with the skill's mandatory workflow and multi-provider fallback, this can accumulate a broad audit trail of sensitive material across sessions.

Static analysis

No suspicious patterns detected.