Back to skill

Security audit

精益六西格玛大师

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese Lean Six Sigma guidance skill with a local plan-generation script and no evidence of hidden access, persistence, networking, or destructive behavior.

Install this if you want Chinese-language Lean Six Sigma project guidance and simple local project-plan generation. Be aware that it may activate for broad quality-improvement requests and that the referenced template directory is not included in the artifact package.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are very broad, covering generic needs such as project execution, quality improvement, solving complex process problems, or learning LSS. In an agent environment, this can cause the skill to activate in many ordinary business or educational conversations where a narrower skill would be more appropriate, creating misrouting risk and unintended influence over responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file presents all instructional content in a single language and does not indicate that the user can choose another language or locale. Under the natural-language policy rules, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

该技能文件全文以中文撰写,未见任何关于语言可选、用户可切换语言,或仅适用于特定中文使用场景的说明。根据规则,若技能在自然语言层面强制特定语言且没有用户选择或合理限定,属于语言/区域策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents the skill guidance entirely in Chinese from the title onward, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains user-facing natural-language strings that require Chinese usage by default, including the title, usage description, and help text. Under the stated policy, forcing a specific language without offering user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The parser description, argument help text, and printed summaries are all hard-coded in Chinese. Because the file does not offer a user-selectable language or clearly justify a Chinese-only locale constraint, this conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.