Security audit

Biz Doc Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chinese-language business document helper that stores generated client, proposal, invoice, and contract files locally, with no evidence of hidden execution, network access, exfiltration, or destructive behavior.

Before installing, treat documents created under ~/biz-docs as potentially sensitive business records. Store them in an appropriate location, review generated legal and financial text before use, and delete or protect client records when they are no longer needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly describes persistent storage of client profiles, invoices, proposals, and contracts under a local directory, but provides no warning, consent flow, retention guidance, or handling instructions for sensitive business and personal data. Because these documents commonly contain names, addresses, pricing, payment details, and contractual terms, silent persistence increases the risk of unintended disclosure, over-retention, and insecure local storage.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The primary description text is presented in Chinese and the usage examples and headings are also Chinese-oriented, but the file does not state that the skill is intended only for Chinese-speaking users or provide a language/locale choice. This can violate language/locale policy when a skill effectively forces one language without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The invocation examples and workflow instructions are entirely in Chinese, which makes the skill effectively language-bound for users reading the usage section. Because there is no explicit note that this is a China-specific or Chinese-only skill, and no user language choice is offered, this may violate language/locale policy.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: This shell script emits all user-facing text in Chinese, including test names, expectations, and notices. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Static analysis

No suspicious patterns detected.