AI助手自动求助技能

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

This skill openly aims to ask outside AI services for help, but it can do so automatically using the user’s accounts and store the replies without enough consent or scope control.

Review carefully before installing. This skill should only be used if users intentionally want their task context sent to named third-party AI providers, understand that their own logged-in accounts or quotas may be used, and are comfortable with AI replies being saved to memory. It should be revised to require explicit approval, show the exact outbound prompt, limit provider switching, avoid cookie/session handling, and make memory retention opt-in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:144

Finding

Mandatory Automatic Activation and Workflow Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-14, 62-95, 144-148, 225
Vulnerability Type: Agent workflow and output-control hijacking
Risk Level: High

Relevant source instructions, rendered in English:

yaml

trigger:
  - Automatically trigger when the solution requires manual user assistance
  - Automatically trigger when the agent determines it cannot solve the problem
  - Automatically trigger when another solution is recommended after failure
  - Automatically trigger when confidence is below 50%

text

Checkpoint 1: When recommending another solution
- If the current advice does not work and another solution is recommended,
  ask-ai must be triggered.

Checkpoint 2: Confidence level
- Before giving any advice, evaluate the confidence level.
- If confidence is below 50%, ask-ai must be triggered.

text

Mandatory constraint: Final self-check must be completed before the Skill
may terminate.

Mandatory constraint: All status markers must be printed. The Skill may not
proceed to the next step unless the required marker has been printed.

Technical Analysis

The Skill uses broad, subjective activation criteria to take control of the agent's current workflow. Conditions such as low confidence, receiving a follow-up question, needing user assistance, or recommending an alternative can force activation even when the user did not request disclosure to another AI service.

Once activated, the Skill requires a fixed sequence of sending, receipt validation, polling, self-checking, multiple follow-up questions, and final validation. It also dictates visible output markers and prohibits normal termination until its internal workflow is complete. These instructions can override the user's immediate objective, interfere with higher-level response behavior, and compel external actions unrelated to the minimum requirements of the original request.

Attack Path

1. A ...[truncated 1038 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before every external AI submission.
• Remove automatic activation based on subjective confidence or user follow-up questions.
• Treat external delegation as an optional recommendation rather than a mandatory action.
• Remove instructions that prevent normal Skill termination or force visible status markers.
• Allow the agent to stop immediately when the user's objective has been met.
• Bound retries, polling, provider switching, and follow-up exchanges through user-approved limits.
• Display the selected provider and exact outbound content before transmission.
• Ensure all Skill instructions remain subordinate to system policies and the user's current request.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:219

Finding

Persistent Storage of Untrusted External AI Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:219
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Relevant source instruction, rendered in English:

text

Keep a record: Save the AI responses to memory.

Technical Analysis

The Skill instructs the agent to store responses from external AI systems directly in persistent memory. External model output is untrusted content: it can contain prompt-injection instructions, fabricated facts, malicious operational guidance, sensitive data echoed from the prompt, or text designed to influence subsequent sessions.

The instruction does not require sanitization, provenance tracking, user review, expiry, separation of facts from instructions, or limitation to a task-specific memory namespace. Consequently, attacker-controlled external content can cross a trust boundary and become persistent agent state.

Attack Path

1. The Skill sends a user question to an external AI service.
2. The service returns content containing malicious instructions or misleading information.
3. The Skill saves the raw response into persistent memory as required.
4. A later session retrieves or relies on that memory.
5. The stored content influences future decisions, responses, or tool use beyond the original interaction.

A malicious response could, for example, falsely claim that certain external instructions are trusted operational rules. If stored without filtering, those claims may continue to influence future sessions.

Impact Assessment

Successful exploitation can create cross-session manipulation of agent behavior, persistent misinformation, privacy retention, and repeated exposure to injected instructions. The scope depends on the memory system's retrieval rules and lifetime. If memory is shared broadly, unrelated future tasks and users may be affected. This issue does not itself establish system-level persistence, but it establishes persistence wi ...[truncated 33 chars]

Remediation

View remediation

Remediation Suggestions

• Do not store raw external AI responses in persistent memory.
• Store only minimal, factual summaries after explicit user approval.
• Remove commands, role directives, tool instructions, links, secrets, and unsupported claims before persistence.
• Label every retained fact with its external source, timestamp, confidence, and task scope.
• Use task-local, expiring storage instead of global long-term memory.
• Prevent stored third-party text from being interpreted as executable agent instructions.
• Scan retained content for prompt injection and sensitive data.
• Provide users with controls to inspect, edit, and delete stored information.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:136

Finding

Unapproved Use of Authenticated User Accounts and Session State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:136, 218
Vulnerability Type: Unauthorized use of authenticated browser sessions
Risk Level: High

Relevant source instructions, rendered in English:

text

- Attempt automatic login by checking cookies.

text

1. Do not use the services for free: Conduct the conversations through the
   user's AI accounts.

Technical Analysis

The Skill directs the agent to inspect cookie-backed login state and conduct conversations using the user's authenticated AI accounts. It does not require explicit per-use authorization before accessing an account, consuming quotas, or sending data under the user's identity.

Existing browser authentication is a privileged capability. The presence of a valid session does not constitute consent for automated account use. Checking cookies or reusing authenticated sessions also exceeds the least-privilege requirements of merely recommending that a user consult another service.

Although the Skill says to stop when interactive verification is required, that safeguard does not address unauthorized use of an already authenticated session.

Attack Path

1. A broad automatic trigger activates the Skill.
2. The agent opens an external AI provider in the browser.
3. The Skill checks for an existing cookie-backed authenticated session.
4. If a session exists, the agent accesses the user's account without a separate approval checkpoint.
5. The agent submits the question and performs multiple follow-up interactions under the user's identity.
6. Provider quotas, billing entitlements, history, or account-linked data are affected.

Impact Assessment

The Skill can exercise the user's authenticated access to third-party AI services. Potential effects include unauthorized account activity, consumption of paid quotas, creation of account history, disclosure of sensitive content, and actions attributed to the user. The scop ...[truncated 151 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user authorization before accessing each provider account.
• Never inspect, extract, expose, or manipulate browser cookies directly.
• Treat an existing logged-in session only as authentication, not authorization for a task.
• Show the provider, account, proposed message, expected number of interactions, and possible quota or billing impact before proceeding.
• Require renewed approval before switching to a different provider.
• Limit account use to the minimum number of interactions necessary.
• Do not submit content under the user's identity without a clear confirmation step.
• Maintain an auditable record of approved external actions without storing authentication material.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:102

Finding

Uncontrolled Disclosure of User Context to Multiple External Providers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:102-117
Vulnerability Type: Unsafe external transmission of user and task information
Risk Level: High

Relevant source template, rendered in English:

text

Hello, I have a technical question:

[Background]
- The user wants to implement: XXX
- I am the user's AI assistant.

[My attempts]
- Solution A: XXX - Result YYY
- Solution B: XXX - Result YYY

[Problem]
- The current blocking issue is ZZZ.

[Please help]
1. Analyze the root cause.
2. Provide a feasible solution.
3. Identify possible pitfalls.

Technical Analysis

The fixed prompt template is designed to transmit the user's objective, background, attempted solutions, observed results, and current failure state to external services. The Skill provides no data-classification, minimization, redaction, secret-detection, or consent procedure before transmission.

The provider failover sequence can send substantially the same context to Doubao, Qianwen, Kimi, and DeepSeek. This multiplies the number of third parties receiving the data and increases the privacy and confidentiality impact. Technical troubleshooting content may include proprietary source code, internal infrastructure details, credentials, personal information, security findings, or regulated data.

Attack Path

1. The user provides confidential or identifying context while requesting help.
2. The Skill activates automatically or through a general request to ask another AI.
3. The agent inserts the objective, prior attempts, results, and blocking issue into the fixed template.
4. The completed template is submitted to the first provider without a required redaction or approval stage.
5. If that provider fails or responds slowly, the Skill automatically switches providers.
6. The same sensitive context may be disclosed to as many as four external services.
7. Follow-up questions can expose additional details duri ...[truncated 562 chars]

Remediation

View remediation

Remediation Suggestions

• Add an explicit approval checkpoint before transmitting any content externally.
• Present the complete outbound prompt and selected provider to the user.
• Remove names, identifiers, credentials, tokens, internal URLs, source code, and confidential details unless strictly necessary and separately approved.
• Implement automatic secret and personal-data detection before submission.
• Minimize prompts to only the information needed to answer the specific question.
• Do not automatically resend content to another provider; require renewed consent for each recipient.
• Define categories of data that must never be transmitted.
• Apply provider-specific privacy and retention disclosures.
• Keep follow-up exchanges within the originally approved disclosure scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is designed to send user questions to third-party AI providers, but it does not require clear notice about what data will be transmitted, to whom, and under what privacy terms. This is dangerous because user prompts may contain sensitive information, and disclosure occurs outside the primary assistant's trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases such as '你问问AI' and '这个我不会', which can cause accidental invocation. In this skill, accidental triggering is especially risky because invocation leads to sending user questions to third-party AI services, potentially disclosing data without deliberate user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic trigger conditions are vague and expansive, such as '判断自己无法解决' or '把握程度<50%'. This allows the skill to activate based on subjective internal states, making external escalation and data sharing much more likely than users would reasonably expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L004 及整份文档均以固定中文指令形式定义技能行为，没有说明可根据用户语言偏好切换，也未提供语言选择机制。若该技能面向通用用户，这种默认强制单一语言可能构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly tells the agent to use the user's AI account and to attempt automatic login by checking cookies. That creates unauthorized account-use and session-handling risk well beyond simple question escalation, and could cause the agent to act under the user's identity on third-party services without clear consent per action.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger decision table remains broad and lacks clear limiting examples, so the boundary for invocation is unclear. In context, this ambiguity matters because activation can lead to external data transfer, login handling, and persistence of responses, magnifying the consequence of false activations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to save third-party AI replies to memory without informing the user that the content will be persisted. This creates a transparency and privacy problem because externally generated responses may include user-sensitive details or derived summaries that remain stored beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Storing third-party AI responses in memory creates a data retention surface for sensitive prompts, outputs, and contextual details that may later be exposed to other tasks or users. The risk is elevated here because the skill already routes user content to outside providers, so persistence compounds an existing data-exposure pathway.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Persisting third-party AI responses to memory introduces unnecessary retention of potentially sensitive user content, prompts, and external outputs. Because the skill's main purpose is escalation to another AI, indefinite or opaque storage is not required and increases leakage, secondary-use, and privacy exposure.

Content

No source excerpt is available for this finding.