Security audit

feedbacklens-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed feedback-analysis and report-generation tool with local file reads/writes and a visible marketing link, but no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with the skill reading the feedback files you point it at and writing report files in the workspace. Review generated reports before sharing because they include original feedback quotes and a visible feedbacklens.cn footer link with UTM parameters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个端到端的用户反馈智能分析技能：输入原始反馈数据，完成聚类、优先级计算、建议生成和报告输出。而实际代码文件明确自述‘只做数据→HTML的机械渲染，不做任何分析判断’，其CLI输入也仅支持 `--demo` 或 `--evaluation` 指向已有 evaluation JSON。代码确实包含一些派生字段补齐逻辑，如按 frequency/severity/impact 计算 priority_score、按 impact/effort 计算 ROI、排序、以及演示标识注入，这些更像对已有分析结果的展示层加工，而不是对原始反馈进行分析。故该代码块的实际主要用途与声明的主要用途存在实质性偏差：它是报告渲染组件，不是完整的反馈智能分析实现。

Ae1

High

Category: analysis-evasion
Content: | `SKILL.md` | 本文件：方法论 + 三步流程 + 验收标准 | 每次触发 |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: | `icon.png` | 技能图标 | 上架展示 |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Hidden Instructions

High

Category: Prompt Injection
Content: id,source,content D001,app_review,"升级到 3.2 版本之后，登录页点进去就是白屏，换浏览器清缓存都不行，已经两天进不去系统了" D002,support_ticket,"手机验证码一直收不到，点了七八次重新发送，最后提示验证码已失效，正常流程根本走不完" D003,app_review,"账号密码明明是对的，一直提示密码错误，重置之后再登还是登不上，人都要疯了"
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The skill description, usage examples, and user invocation phrases are entirely in Chinese, which indicates the skill is designed to operate in a fixed language. The file does not mention any option to use another language or that the Chinese-only scope is intentional and region-specific, so this is a natural-language locale policy concern.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that generated reports automatically include a footer CTA linking to an external site with UTM tracking, but it does not present this as a user-facing privacy/security consideration or clearly warn that reports shared onward will contain outbound tracked links. In the context of a reporting skill, this creates a hidden data-disclosure and consent problem: report viewers may leak engagement metadata to a third party, and users may unknowingly distribute externally tracked content.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill instructs the agent to read local files and write reports into the workspace, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity: a host may grant broader file access than users expect, increasing the chance of unintended file reads/writes or unsafe integration behavior.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The primary display name and the full operational instructions are presented in Chinese, and the file does not clearly state that the user can choose the response language. Under the policy, locale or language should not be forced without opt-in unless the constraint is documented and justified.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases are broad enough that routine language could invoke the skill outside a clearly intended feedback-analysis context. Accidental activation matters here because the skill then encourages file reading and report writing behaviors, which can cause unintended processing of local data.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The demo-mode triggers include generic phrases like '试一下' or '看看效果', which can activate the skill without a clear request to analyze feedback. In context, that increases the risk of unintended report generation, demo execution, and workspace writes without sufficiently specific user intent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill behavior includes reading local CSV/Excel files and writing analysis artifacts, but the description does not clearly warn users about those file operations. That weakens informed consent and can lead users to expose local data or accept filesystem changes they did not anticipate.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JSON file’s user-facing natural-language fields, including the title, descriptions, quotes, and suggestions, are entirely in Chinese. Per the policy, forcing a specific language without user opt-in or a clearly documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file’s user-facing text content is entirely in Chinese across all records, with no indication that language choice is optional or that the dataset is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in or clear justification is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: This JSON manifest-like file describes when the industry anchors should be used, but the condition is broad: '用户声明行业时用对应锚点，未声明默认 SaaS/工具'. It does not define specific trigger phrases, scope boundaries, or exclusion conditions, which could lead to unintended invocation in loosely related conversations about industries or prioritization.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation explicitly states the script only does mechanical 'data → HTML' rendering and does not perform analytical judgment. However, `_normalize` recomputes `priority_score`, infers `priority_level` using threshold logic and a severity fallback rule, and derives ROI/quick-win flags, which are analytical transformations rather than pure rendering.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The HTML root sets `lang="zh-CN"`, and the visible report text throughout the template is fixed in Chinese, which indicates the skill output is constrained to a specific language/locale. The file does not offer a language choice or document that this is a region-specific tool, so this is a natural-language locale policy concern.

Context-Inappropriate Capability

Low

Confidence: 95% confidence
Finding: The skill embeds lead-generation behavior and mandatory UTM-tagged CTA links unrelated to the core analysis task. While not directly a system compromise, this introduces undisclosed tracking/marketing behavior and can steer outputs toward data collection objectives rather than user interests.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The natural-language description is entirely in Chinese and sets a default operational context ('未声明默认 SaaS/工具') without indicating any language or locale choice for the user. For multilingual environments, this can amount to a language/locale policy issue because the file assumes Chinese-language operation without offering opt-in or alternatives.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The design notes describe automatic degradation/fill-in for missing fields, implying non-semantic completion for rendering robustness. In practice, the code synthesizes scoring explanations, priority levels, ROI, quick-win determinations, sorting order, and even a fallback overall conclusion, which goes beyond simple field completion.

Static analysis

No suspicious patterns detected.