Security audit

Retail Knowledge

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent retail knowledge-base Q&A skill with a local search helper and no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Before installing, confirm that the configured knowledge base contains only information the retail assistant should disclose to customers or staff, and that the deployment locale/language expectations match your store. The broad triggers may make this skill answer many retail questions, so pair it with accurate KB freshness metadata for prices, promotions, and inventory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
Maintain context across turns within a session: - Remember what product was mentioned earlier ("那款" / "刚才说的那个") - Remember stated preferences ("她喜欢素色" → filter subsequent answers) - If user backtracks or changes topic, reset context gracefully **Reference:** [conversation-patterns.md](references/conversation-patterns.md)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/search-strategy.md (reported line 73)May include surrounding context.
md
|------------|--------------------|--------------------| | Inventory | > 2 hours | Add caveat: "截至[time]的数据，建议现场确认" | | Promotions | > 24 hours | Add caveat: "活动信息以最新公告为准" | | Product info | > 7 days | No caveat needed (specs rarely change) | | Policies | > 30 days | No caveat needed | | Prices | > 24 hours | Add caveat if `sale_price` is set |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/search-strategy.md (reported line 74)May include surrounding context.
md
|------------|--------------------|--------------------| | Inventory | > 2 hours | Add caveat: "截至[time]的数据，建议现场确认" | | Promotions | > 24 hours | Add caveat: "活动信息以最新公告为准" | | Product info | > 7 days | No caveat needed (specs rarely change) | | Policies | > 30 days | No caveat needed | | Prices | > 24 hours | Add caveat if `sale_price` is set |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are very broad and overlap with ordinary retail conversation, which can cause the skill to activate when the user did not intend a policy/knowledge lookup flow. Unintended invocation can misroute requests, expose internal business logic, or cause the agent to answer from stale or incomplete store knowledge instead of using a more appropriate workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The query routing keywords and answer examples are overwhelmingly Chinese, including the only concrete good-answer examples, but the file does not state that language should be selected based on user preference or locale. This can create a language-policy issue by implicitly steering responses to a specific language without explicit opt-in or choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The answer templates and examples are written as mandatory output patterns in Chinese, indicating the skill is expected to answer in a fixed language. The file does not mention offering users a language choice or limiting this to a justified region-specific context, which conflicts with the language/locale policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The clarification template is written only in Chinese, and the surrounding examples and closing phrases throughout the file consistently prescribe Chinese responses. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific deployment, which may violate language/locale policy constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file includes locale-specific examples such as pricing in CNY, which can signal a fixed language/locale assumption in the skill documentation. Because the file does not state that the schema is China-specific or otherwise offer locale flexibility, it may conflict with the policy against forcing a specific locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example variant values use Chinese color names only, which suggests a language-specific constraint in the schema reference. Since the document does not explain that the skill is region-specific or allow alternative locales, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Examples like "满300减50" and "每消费1元得1积分" embed a specific language and retail locale, but the document does not state that the schema is limited to that locale. This may be interpreted as forcing a language/locale by default rather than documenting a user-selected or region-specific configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.