Back to skill

Security audit

面经-商业分析面试通关

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only bilingual interview-prep skill; the scanner flags are mostly language/section comments and broad trigger wording, not unsafe behavior.

Before installing, note that this skill is a paid bilingual interview-prep reference with many reusable templates. It should not be treated as personalized legal, immigration, or financial advice for salary negotiations, and broad interview-related prompts may invoke it more often than expected.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (36)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
# 🎯 面经 / Interview Master — BA & Data Analyst Interview Guide

<!-- LANG: Detect user language and respond in the same language. If the user writes in English (or any Latin script), reply in English. If Chinese, reply in Chinese. -->

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md
**回答策略**:见 `references/methodologies.md`

<!-- EN -->
**Common Follow-ups**:
- "What is PSM/DID? What are its pros and cons?"
- "What type of A/B test did you run?"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

找到使用和未使用AI选房工具的两批人,做分组对照分析。

text

<!-- EN -->
**Definition**: Propensity Score Matching — finds matched control/treatment groups based on similar observable characteristics to reduce selection bias.

**Key Points**:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

我通过PSM找到特征相近的两批经纪人(各300人),然后用DID评估AI选房工具的效果。

text

<!-- EN -->
**Definition**: Difference in Differences — compares treatment and control groups before and after an intervention to isolate the causal effect from time trends and confounders.

**Key Points**:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

通过人工+模型的方式让分级更科学。

text

<!-- EN -->
**Use Case**: Supplements manually-set RFM thresholds when the data distribution doesn't align with business intuition.

**Interview Answer Example**:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/resume_tips.md (reported line 72)May include surrounding context.

2.1 公式 / Formula

text
[项目名称] + [业务背景] + [我的职责] + [方法] + [量化成果]

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/resume_tips.md (reported line 144)May include surrounding context.

  • "得到业务认可"
text

<!-- EN -->

✅ Quantify by:

  • % improvement (e.g., +57% conversion rate)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 9)May include surrounding context.

1.1 了解渠道 / Research Channels

text
1. 招聘网站 — BOSS直聘、拉勾
   看同类岗位的薪资范围

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 9)May include surrounding context.

1.1 了解渠道 / Research Channels

text
1. 招聘网站 — BOSS直聘、拉勾
   看同类岗位的薪资范围

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 189)May include surrounding context.

具体可以协商。"

text

<!-- EN -->

"Based on my X years of experience, my skill set, and current market rates, I'm targeting an annual package of $XX, or a monthly base of $XXK+.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 220)May include surrounding context.

能否给我1-2天时间确认?"

text

<!-- EN -->

Script 1 (Anchor on value): "The market rate for this level is $20K+, and with my XX experience that's highly relevant

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 250)May include surrounding context.

希望能在薪资上有所体现。"

text

<!-- EN -->

"I'm also considering another offer at $XXK with solid overall terms. I'm genuinely more interested in this opportunity, and I'd love to find a way

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/salary_negotiation.md (reported line 297)May include surrounding context.

❌ 抱怨前公司 — "上家给得太低了" → 会让人觉得你没价值

text

<!-- EN -->

❌ Salary-only focus — show genuine interest in the role and company ❌ Bluffing — have real leverage, never fake competing offers

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 14)May include surrounding context.

  • "怎么设计XX功能的评估指标?" / "How would you design metrics to evaluate XX feature?"
  • "北极星指标是什么?怎么拆解?" / "What is the North Star metric? How do you break it down?"

解题框架:

text
1. 理解业务目标

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 14)May include surrounding context.

  • "怎么设计XX功能的评估指标?" / "How would you design metrics to evaluate XX feature?"
  • "北极星指标是什么?怎么拆解?" / "What is the North Star metric? How do you break it down?"

解题框架:

text
1. 理解业务目标

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 214)May include surrounding context.

→ 量化结果:转化率提升57%

text

<!-- EN -->

Issue 1: Passive usage inflating adoption

  • 60% adoption rate, but 40% was accidental/passive taps

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 214)May include surrounding context.

→ 量化结果:转化率提升57%

text

<!-- EN -->

Issue 1: Passive usage inflating adoption

  • 60% adoption rate, but 40% was accidental/passive taps

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 272)May include surrounding context.

  • 投诉率
text

<!-- EN -->

North Star metrics:

  • Match success rate

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 310)May include surrounding context.

  • 供需平衡分析
text

<!-- EN -->
  1. User segmentation
    • High-frequency shippers vs. low-frequency

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 408)May include surrounding context.

Q: 你觉得哪些行业发展比较好?

text

<!-- EN -->

Q: How much do you know about our company/industry? Q: What are the biggest pain points in this industry?

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/business_cases.md (reported line 683)May include surrounding context.

和产运对齐后推AB测试验证。"

text

<!-- EN -->

Q: If you were to drive growth for Company A using data, what would you do?

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/interview_questions.md (reported line 3)May include surrounding context.

md
# 面试问题分类详细清单 / Interview Question Bank by Category

<!-- LANG: Match the user's language. CN questions → CN answer guidance. EN questions → EN answer guidance. Both languages always available below each heading. -->

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/methodologies.md (reported line 3)May include surrounding context.

md
# 数据分析方法论详解 / Data Analytics Methodology Deep-Dives

<!-- LANG: Reply in the user's language. Match CN/EN accordingly. -->

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/methodologies.md (reported line 241)May include surrounding context.

  1. 做显著性检验
text

<!-- EN -->
This is the most frequently tested combo in BA/DA interviews!

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/methodologies.md (reported line 281)May include surrounding context.

md
4. 重新计算每个簇的中心
5. 重复3-4,直到中心不再变化

<!-- EN -->
**Definition**: K-means partitions data into K clusters to minimize within-cluster variance.

**Algorithm steps**:

Static analysis

No suspicious patterns detected.