Security audit

Quality Month

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language planning assistant for quality-month documents, with no packaged executable code or hidden access behavior found.

Before installing, expect this skill to draft quality-month planning materials in Chinese from information you provide. Review any generated slogans, publicity copy, budgets, dates, responsibilities, and performance metrics before use, because the skill is designed to mark uncertain items for confirmation rather than verify real-world facts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest description states 'Agent 只引导不替写', implying a bounded role of elicitation rather than authorship. However, the same manifest says it will '产出' the overall plan and supporting schedule, publicity copy, and summary/evaluation documents, which are substantive deliverables rather than mere guidance; the body of the skill repeats this generation behavior in L016-L018 and L072-L085.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The '不能做什么' section says the agent will not decide key content and that the skill outputs only '方案与文案' for the user to execute, reinforcing a limited guidance posture. But elsewhere the documentation states it '生成宣传文案包', '生成总结与评优材料', and after outline confirmation '生成正文' into MD and HTML files, which is active drafting rather than merely guiding; this is an intent/documentation contradiction, not just missing detail.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The TRACE self-assessment explicitly claims '完整中文交互', which indicates the skill is designed to operate in Chinese only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless a justified locale constraint is clearly documented.

Static analysis

No suspicious patterns detected.