Back to skill

Security audit

Oee Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese-language OEE calculation and reporting guide with no executable payload, persistence, credential use, or hidden data movement.

Before installing, expect this skill to process manufacturing performance data that you provide and to generate OEE/ROI reports with default assumptions when your company-specific parameters are missing. Review those assumptions before using the output for business decisions.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is written to produce Chinese-language output by default without indicating user choice or language negotiation. Forcing a language can mislead users, reduce reviewability, and increase the chance that important assumptions, ROI caveats, or warnings are misunderstood by operators who expect another language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation description contains broad trigger phrases such as 'OEE分析、设备效率评估、产能诊断或OEE改善项目时使用', which could cause the skill to activate for a wide range of ordinary manufacturing-analysis requests even when the user did not explicitly ask for this skill. Over-broad activation increases the chance of inappropriate routing, unnecessary data handling, and the model applying this skill's assumptions or defaults in contexts where a different workflow would be safer or more accurate.

Content

No source excerpt is available for this finding.