深度技术报告生成器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent technical-report generator, but it can automatically publish generated content to external Tencent/IMA services using local credentials without a clear approval gate.

Review before installing if your reports may contain internal architecture, benchmarks, roadmap details, personal data, or secrets. Use it only with explicit local-only or publish confirmation expectations, and verify the IMA knowledge base, Tencent Docs destination, and credential scope before allowing synchronization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises automatic synchronization to external knowledge systems without any visible requirement for user consent, data classification, or warning that content will leave the current environment. This creates a real risk of sensitive prompts, internal technical details, or proprietary training material being exfiltrated to third-party or shared systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The workflow explicitly mandates uploading generated content to IMA knowledge base and Tencent Docs, including tool calls and file upload steps, but does not include a user approval gate. In context, this is more dangerous because the skill is meant for technical reports and onboarding documents, which frequently contain internal architecture, benchmarks, roadmap details, or other sensitive corporate information.

Hidden Instructions

High

• Category: Prompt Injection

Content

### 字体规范

```xml
<!-- 标题 -->
<text font-size="18" font-weight="bold" font-family="system-ui, -apple-system, sans-serif">

<!-- 副标题 -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- 副标题 -->
<text font-size="15" font-weight="600" font-family="system-ui, -apple-system, sans-serif">

<!-- 正文 -->
<text font-size="13" font-family="system-ui, -apple-system, sans-serif">

<!-- 标注/注释 -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The description is framed as '面向新人培训' and the skill content is written to operate in Chinese, but it does not state that language can be adapted based on user preference. This can violate language-choice policy when users may expect reports in another language or locale.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to match many ordinary documentation or explanation requests, which can cause the skill to activate in contexts the user did not specifically intend. Because this skill also includes downstream publishing behavior, overbroad activation increases the chance of unintended document generation and follow-on data handling actions.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template sets the document language to `zh-CN`, and the visible report content is also written entirely in Chinese. This imposes a specific language/locale by default with no opt-in, fallback, or explanation that the skill is intended only for a China-specific audience, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown template is entirely framed in Chinese, starting with the title, and presents the report structure as a fixed default rather than offering language selection. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly reads long-lived local credentials from disk and sends them in request headers to a remote API, but provides no warning about secret handling, scope, storage, rotation, or the risk of exposing those values in shell history, logs, or shared environments. In an agent skill context, documenting credential access and outbound transmission without safety guardrails can normalize unsafe secret handling and increase the chance of accidental credential disclosure or misuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

API_KEY=$(cat ~/.config/ima/api_key)

# Step 2: Preflight Check（验证连接）
curl -s "https://api.ima.qq.com/open/knowledge/check" \
  -H "client_id: $CLIENT_ID" \
  -H "api_key: $API_KEY"

• Confidence: 86% confidence
• Finding: This step performs outbound transmission to a third-party API while attaching local credentials in headers. The call itself may be legitimate, but in a skill that automates synchronization, any implicit external network action involving secrets is security-relevant and dangerous if users are not clearly informed or if the action is triggered on sensitive content.

External Transmission

Medium

• Category: Data Exfiltration

Content

API_KEY=$(cat ~/.config/ima/api_key)

# Step 2: Preflight Check（验证连接）
curl -s "https://api.ima.qq.com/open/knowledge/check" \
  -H "client_id: $CLIENT_ID" \
  -H "api_key: $API_KEY"

• Confidence: 86% confidence
• Finding: This step performs outbound transmission to a third-party API while attaching local credentials in headers. The call itself may be legitimate, but in a skill that automates synchronization, any implicit external network action involving secrets is security-relevant and dangerous if users are not clearly informed or if the action is triggered on sensitive content.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "api_key: $API_KEY"

# Step 3: 检查重名（避免重复上传）
curl -s "https://api.ima.qq.com/open/knowledge/check_repeated_names" \
  -H "client_id: $CLIENT_ID" \
  -H "api_key: $API_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 78% confidence
• Finding: This request sends authenticated metadata about files to a remote service to check duplicate names. Although lower risk than uploading file bodies, it still transmits internal document names and uses local API credentials, which can leak project details or naming conventions and expands the external data-sharing surface.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"kb_id": "KB_ID", "names": ["文件名.md"]}'

# Step 4: 创建媒体（获取上传凭证）
curl -s "https://api.ima.qq.com/open/knowledge/create_media" \
  -H "client_id: $CLIENT_ID" \
  -H "api_key: $API_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 81% confidence
• Finding: The create-media step sends authenticated requests containing knowledge-base identifiers and file metadata to an external service. In this skill context, that is part of an automated upload workflow and becomes dangerous when combined with missing consent and sensitivity review, because it prepares exfiltration of user-generated documents to a third-party platform.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs users to upload local Markdown/HTML content to external services but does not warn that the content may contain sensitive internal data, secrets, or proprietary information. In a report-generation skill that may process onboarding and technical materials, omission of a data-sensitivity warning materially increases the risk of unreviewed exfiltration of confidential content to third-party platforms.

External Transmission

Medium

• Category: Data Exfiltration

Content

--data-binary @文件路径.md

# Step 6: 完成入库
curl -s "https://api.ima.qq.com/open/knowledge/add_knowledge" \
  -H "client_id: $CLIENT_ID" \
  -H "api_key: $API_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 84% confidence
• Finding: This step finalizes adding the uploaded file into the external knowledge base using authenticated API calls, completing the transmission of local report content to a remote system. In a training/report skill that may handle internal technical material, this meaningfully increases confidentiality risk if content classification, review, and user consent are not enforced.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This markdown guide is primarily written in Chinese while several template labels remain in English, and there is no note about supported language options or intended audience. Under the policy rule for language/locale, a skill document that implicitly fixes language expectations without user opt-in can be considered a policy concern.

Static analysis

No suspicious patterns detected.