Security audit

伴游AI旅游搭子

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language travel narration skill with no executable code, persistence, credential handling, or hidden data flow; its main caveats are broad travel activation and mandatory formatting/style preferences.

Install this if you want a Chinese-language cultural travel narrator that may search for current attraction details. Users should be aware that it may activate on broad travel requests and applies strong Chinese formatting/style rules, so it may be less suitable for booking, emergency, visa, or non-Chinese travel assistance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation description is broad enough to trigger on ordinary travel-information requests, increasing the chance this skill intercepts queries better handled by a general assistant or a more specialized, safety-constrained skill. Over-broad activation can cause inappropriate tool routing, unnecessary external lookups, and unexpected style or policy constraints to be applied without clear user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prohibition list bans Chinese and numeric ordered list formats, and the overall instructions are written as mandatory output constraints rather than optional formatting preferences. This can force a specific language/locale presentation style regardless of user preference, which is a natural-language policy concern because no user opt-in is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all instructions and examples solely in Chinese, and nowhere indicates that the skill is China/Chinese-specific or that users may opt into another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Natural-language policy checks apply to all file types. The display name, description, tags, capabilities, and style labels are all presented only in Chinese, with no indication that users may choose another language or locale, which can be interpreted as forcing a specific language experience without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is broad and describes general travel guidance, personalized recommendations, and location-aware behavior without clear activation boundaries. In an agent ecosystem, this can cause the skill to be invoked for loosely related travel queries, increasing unintended data exposure or inappropriate routing even if the skill itself is not overtly malicious.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.