Security audit

Mit24 Team Building

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese instructional skill for MIT-style startup product validation and team planning, with no executable code or hidden system access.

Safe to install from a system-access perspective. Use it as general startup-planning guidance, and be cautious about sharing confidential customer details, equity terms, contracts, or fundraising information in agent context.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list is very broad and includes generic terms like Demo、合伙人、联合创始人、团队角色, which commonly appear in ordinary startup or product conversations. This can cause unintended skill activation, leading the agent to inject a rigid framework where it was not requested and potentially override more appropriate domain-specific guidance.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The skill is written entirely in Chinese and the description implies Chinese-language behavior without stating that output should follow user language preference. If auto-activated for users communicating in another language, it can degrade usability, cause misunderstanding, and make the resulting guidance less actionable.

Static analysis

No suspicious patterns detected.