sharpinput

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

The skill is a prompt-improvement tool, but it asks for broad agent, shell, and file permissions while silently storing and reusing bundled user preference history.

Review this skill before installing. Its prompt-improvement behavior is understandable, but install only if you are comfortable with broad tool permissions, general-purpose subagent delegation, and package-local preference history that is read, updated, and reused across sessions. Remove the bundled preference files and disable or gate self-learning before normal use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T02 · Agent Memory Poisoning

Error

• Location: references/self-learning.md:103

Finding

Persistent User Profiling and Silent Cross-Session Behavioral Influence

Content

View full analysis

Vulnerability Details

File Location: references/self-learning.md:103-111
Vulnerability Type: Persistent memory poisoning and non-consensual profiling
Risk Level: High

Vulnerable Code Snippet

markdown

## When to Write — Includes Outcome Tracking (v2.4+)

After Stage 3 Step 2 outputs the final question:
1. Extract all applicable fields from this session into JSON format
2. Read `references/user-preferences.json`
3. Append this session's data to the `history` array (keep last 10 entries only)
4. Recalculate the `summary` section from the last 10 entries
5. Update `last_updated` to current date
6. Write back as valid JSON

Related behavior appears at references/self-learning.md:136-139:

markdown

## When to Read

After Gate, before Intent Recognition (the Memory Load step):
1. Read `references/user-preferences.json`
2. If `summary` exists, apply preferences silently
3. If file doesn't exist or is empty, skip

Context autofill is defined at references/self-learning.md:184-197 and covers role, technology stack, budget, team size, domain, and common constraints.

Technical Analysis

The Skill automatically extracts contextual and behavioral information after interactions and writes it to persistent package-local storage. On later invocations, the stored summary is loaded and applied silently to intent detection, route selection, prompt generation, and recommendation behavior.

No explicit opt-in, per-field consent, user-isolated storage, or notice before collection is required. The stored correction map and preference fields may also contain attacker-controlled text derived from conversations. Because these values influence future sessions, a malicious or misleading interaction can poison persistent state.

Silent context autofill creates an additional integrity risk: stale, incorrect, or attacker-supplied values can replace placeholders in later prompts without being con ...[truncated 1288 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable persistent learning by default and require explicit informed opt-in before the first write.
2. Display the exact fields, purpose, retention period, and storage location before obtaining consent.
3. Isolate preference storage by authenticated user and workspace; never use one package-level file for multiple users.
4. Treat all stored values as untrusted data and validate them against strict schemas and length limits.
5. Do not store arbitrary intent-correction patterns or other instruction-like text without sanitization.
6. Require current-session confirmation before using stored budgets, roles, constraints, or technology choices.
7. Do not apply preferences silently. Clearly identify each stored value that affected the output.
8. Provide inspection, selective deletion, export, reset, and retention controls.
9. Avoid inferring feedback scores from tone; only store feedback explicitly submitted for that purpose.
10. Keep persistent data outside the installed Skill package and protect it with appropriate access controls.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/user-preferences.json:5

Finding

Populated User History and Contextual Data Included in the Distributed Package

Content

View full analysis

Vulnerability Details

File Location: references/user-preferences.json:5-29
Vulnerability Type: Plaintext sensitive contextual data exposure and cross-user contamination
Risk Level: Medium

Vulnerable Code Snippet

json

{
  "timestamp": "2026-05-07",
  "level_used": 3,
  "level_assigned": 3,
  "language": "zh",
  "pressure_strategy": "regret pre-mortem + hidden-assumption exposure",
  "strategy_skipped": null,
  "angle_selected": "risk-first",
  "paths_presented": ["risk-first", "counter-intuitive", "minimalist"],
  "user_choice": "single",
  "choice_detail": "A: risk-first (recommended)",
  "feedback": "great",
  "outcome_score": null,
  "outcome_note": null,
  "context_tech_stack": null,
  "context_budget": "~200/month",
  "context_team_size": null
}

The source package also contains a duplicate legacy profile in references/user-preferences.md:5-24, including summarized professional context, budgets, behavioral preferences, and detailed prior task history.

Technical Analysis

The package includes a populated preference database rather than an empty schema or an explicitly synthetic fixture. The records expose timestamps, budget information, work context, technology usage, task domains, constraints, selected analysis paths, and feedback.

The same profile is duplicated in JSON and Markdown, increasing the disclosure surface. Since the self-learning workflow reads the JSON summary and applies it to later interactions, this is also an integrity issue: new users can inherit another user's behavioral and contextual profile.

The data is stored in plaintext under the project reference directory and has no demonstrated user isolation, encryption, access control, or packaging exclusion.

Attack Path

1. The Skill package is published, copied, installed, archived, or shared with its populated preference files.
2. A recipient or process with access to the package reads ...[truncated 841 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all populated preference and history files from the distributable package.
2. Replace them with an empty schema or clearly labeled synthetic test data.
3. Add runtime preference files to version-control ignore and package-exclusion rules.
4. Remove the duplicate Markdown profile and verify that it is absent from repository and release history.
5. Store runtime preferences in a per-user application-data directory rather than under references/.
6. Apply file permissions that limit access to the owning user.
7. Add automated release checks that reject packages containing non-empty history arrays or profile summaries.
8. Review prior releases and repository history for exposed records and remove them where operationally possible.
9. Notify affected users if the records represent real interaction data that was previously distributed.

T01 · Skill Instruction Hijacking

Error

• Location: references/judge-prompt.md:149

Finding

Prompt Injection Through Raw User Content Passed to a General-Purpose Judge Agent

Content

View full analysis

Vulnerability Details

File Location: references/judge-prompt.md:149-181
Vulnerability Type: Indirect instruction hijacking across agent boundaries
Risk Level: High

Vulnerable Code Snippet

markdown

### Step 2: Fill in placeholders

Replace all `{{...}}` placeholders with actual values from the current session:
- `{{ORIGINAL_QUESTION}}` = user's raw input
- `{{PATH_COUNT}}` = 2 or 3
- `{{PATH_A_LABEL}}` = first path's angle tag
- `{{PATH_A_QUESTION}}` = first path's full optimized question
- Same for B and C

### Step 3: Call the Agent tool

```json
{
  "description": "SharpInput Judge — independent path review",
  "prompt": "[filled-in template from Step 2]",
  "subagent_type": "general-purpose"
}

text

The template definition at `references/judge-prompt.md:11-21` explicitly identifies `{{ORIGINAL_QUESTION}}` as raw user input and directs the main agent to substitute it into the Judge prompt.

### Technical Analysis

Raw user content and generated prompt paths are interpolated directly into a larger instruction prompt. The inserted content is not structurally separated from Judge instructions, encoded as inert data, or accompanied by a strong instruction that directives inside the data must not be followed.

A crafted original question can contain text addressed to the Judge, instructions to ignore the review format, fabricated report sections, or requests to reveal other prompt content. Since the receiving agent is configured as `general-purpose`, the delegated execution boundary may expose more capabilities than a review-only component requires.

Output parsing based on textual markers such as `=== JUDGE REPORT ===` is also vulnerable to delimiter injection. An attacker can include those markers in the original question or path text and attempt to confuse parsing or supply attacker-selected risk results.

### Attack Path

1. The user submits an original question containing embe
...[truncated 1218 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a structured agent API with separate instruction and data fields instead of string interpolation.
2. Assign the Judge a restricted review-only agent type with no filesystem, network, shell, write, or delegation tools.
3. Place untrusted content in clearly delimited data blocks and explicitly state that all instructions inside those blocks are inert data.
4. Encode or escape user-controlled delimiters and reject reserved report markers in interpolated fields.
5. Use a strict machine-readable response schema rather than parsing free-form textual markers.
6. Validate all returned fields, allowed enum values, lengths, and path counts before merging the report.
7. Reject responses containing unexpected sections, tool requests, prompt disclosures, or additional instructions.
8. Do not include the full raw question when a minimal, sanitized task summary is sufficient.
9. Add adversarial tests covering nested instructions, fake report markers, role changes, and prompt-exfiltration requests.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:11

Finding

Excessive Bash, Filesystem, Write, and Agent Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11
Vulnerability Type: Violation of least privilege
Risk Level: High

Vulnerable Code Snippet

yaml

allowed-tools: Read, Write, Glob, Bash, AskUserQuestion, Agent

Technical Analysis

The declared purpose of SharpInput is prompt clarification and rewriting. That function does not require arbitrary shell execution. Broad globbing and unrestricted filesystem writes are also unnecessary for normal prompt compilation.

The Write permission supports the optional profiling system, while Agent supports Judge delegation, but both are granted globally rather than only when a user explicitly enables the relevant feature. When these permissions are combined with user-controlled prompt content and subagent delegation, a successful instruction-hijacking attack has a substantially larger capability surface.

Merely declaring broad tools does not prove that they were abused in the audited package. The security defect is that the Skill requests privileges beyond its legitimate minimum requirements.

Attack Path

1. A user supplies adversarial prompt content or poisons persistent preference data.
2. The content changes the main agent's or delegated agent's intended behavior.
3. The compromised workflow has access to globally allowed tools.
4. It may attempt arbitrary shell commands, broad filesystem discovery, file modification, or additional agent delegation.
5. The host tool-policy layer becomes the only remaining control preventing unauthorized operations.

Impact Assessment

The maximum potential scope includes the privileges exposed by the host implementation of Bash, Read, Write, Glob, and Agent. Depending on sandboxing, this could include command execution, workspace enumeration, file modification, deletion, and delegation to other agents.

No malicious shell command or confirmed command execution was found in the project. Therefore, ...[truncated 105 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash; no audited prompt-rewriting behavior requires shell execution.
2. Remove Glob or restrict discovery to a fixed allowlist of packaged reference files.
3. Restrict Read to the Skill's own immutable resources.
4. Disable Write by default and enable it only after explicit consent to persistent learning.
5. Restrict writes to a dedicated per-user data file outside the package.
6. Replace the general-purpose Agent capability with a tool-free, review-only subagent.
7. Apply capabilities per route rather than globally. Quick rewrite should require no filesystem or delegation tools.
8. Enforce host-level sandboxing, path allowlists, command denial, and auditable user confirmation for privileged operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/self-learning.md:8

Finding

Destructive Legacy Preference Migration Triggered Without Confirmation

Content

View full analysis

Vulnerability Details

File Location: references/self-learning.md:8-9
Vulnerability Type: Unsafe destructive file migration
Risk Level: Medium

Vulnerable Code Snippet

markdown

**Storage**: `references/user-preferences.json` (JSON format, schema-defined, NOT workspace memory)
**Migration note**: If `references/user-preferences.md` exists with data, one-time migrate to JSON on first read, then delete the `.md` file.

Technical Analysis

The migration is initiated during a read-oriented workflow and directs the agent to delete the source Markdown file after migration. The instructions do not require explicit user confirmation, a backup, atomic replacement, checksum comparison, or verified semantic equivalence before deletion.

Although later instructions require JSON structural validation for normal writes, they do not establish a transactional migration procedure. If conversion is incomplete, fields are dropped, the destination path is wrong, or the write is interrupted, deleting the legacy file can cause irreversible loss.

The package currently contains both the Markdown and JSON preference files, making the migration path immediately reachable when the self-learning reference is followed.

Attack Path

1. The Skill is invoked and detects the existing legacy Markdown preference file.
2. It parses the file and attempts to create or update the JSON preference file.
3. A conversion error, partial write, schema mismatch, interruption, or incorrect field mapping occurs.
4. The workflow deletes the Markdown source without explicit confirmation or a retained backup.
5. Preference history or contextual information is permanently lost or corrupted.

Impact Assessment

The affected privilege is filesystem write and deletion access within the Skill installation or workspace. The primary impact is local data loss, profile corruption, and unexpected modification of distributed package files.

...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

1. Never delete the source file automatically during the first read.
2. Write the converted JSON to a temporary file in the same directory.
3. Flush and atomically rename the temporary file only after complete schema and semantic validation.
4. Compare migrated record counts and critical fields against the source.
5. Retain a timestamped backup until the user explicitly confirms successful migration.
6. Require explicit confirmation before deleting or archiving the legacy file.
7. Make migration idempotent so interrupted operations can safely resume.
8. Log migration status without recording additional sensitive content.
9. If validation fails, preserve the source unchanged and continue in a read-only degraded mode.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

| Trigger skill | `SKILL.md` | compact runtime checklist loaded on trigger |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/output-templates.md (reported line 99)May include surrounding context.

md

If interactive option selection is available, ask the user to pick one or more paths using `AskUserQuestion`. If not, recommend the lowest-risk path first and still include all paths in text.

## Output Rules

- Keep the user's language unless the user asks for another language.
- Always include one complete upgraded prompt.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The rule Do not ask "背景/目标/场景" as a generic bundle hardcodes Chinese phrasing without user opt-in, which can force a language-specific interaction pattern inconsistent with the user's language. In a prompt-refinement skill, this can degrade user understanding, cause misleading outputs, or break downstream workflow assumptions, especially in multilingual environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger language is broad enough to activate on ordinary conversations about wording, clarity, or writing quality, not just prompt optimization. Over-broad activation increases the chance of misrouting user requests into a skill with extra tools and internal orchestration logic, which can expand attack surface and cause unintended access to subordinate skills or filesystem capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata grants Read, Write, Glob, and Bash even though the description explicitly says the skill should not be used for file operations. This creates a capability/intent mismatch: if the skill is triggered incorrectly or subverted by adversarial user content, it has unnecessary authority to inspect or modify files and invoke shell commands beyond its stated purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example trigger phrase "帮我润色/理清/改一下" is ambiguous and can match many unrelated editing requests. In this skill, ambiguity matters because activation could route non-prompt tasks into a more privileged workflow than necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The mixed-intent disambiguation prompt is written only in Chinese, which imposes a language choice in natural-language instructions without any opt-in or indication that language should match the user's preference. This can violate language or locale policy when used with users interacting in other languages.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

| Need | Read |
|------|------|
| identify primary/secondary intent | `skills/intent-detection/SKILL.md` |
| detect concrete scenario | `skills/scenario-detection/SKILL.md` |
| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

| Need | Read |
|------|------|
| identify primary/secondary intent | `skills/intent-detection/SKILL.md` |
| detect concrete scenario | `skills/scenario-detection/SKILL.md` |
| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

|------|------|
| identify primary/secondary intent | `skills/intent-detection/SKILL.md` |
| detect concrete scenario | `skills/scenario-detection/SKILL.md` |
| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

| identify primary/secondary intent | `skills/intent-detection/SKILL.md` |
| detect concrete scenario | `skills/scenario-detection/SKILL.md` |
| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

| detect concrete scenario | `skills/scenario-detection/SKILL.md` |
| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |
| review high-risk prompts | `skills/judge-review/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| ask scenario-specific slots | `skills/scenario-slot-elicitation/SKILL.md` |
| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |
| review high-risk prompts | `skills/judge-review/SKILL.md` |
| format user-facing output | `skills/output-renderer/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

| fill generic missing context | `skills/context-completion/SKILL.md` |
| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |
| review high-risk prompts | `skills/judge-review/SKILL.md` |
| format user-facing output | `skills/output-renderer/SKILL.md` |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

| clarify vague subjective description | `skills/description-clarifier/SKILL.md` |
| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |
| review high-risk prompts | `skills/judge-review/SKILL.md` |
| format user-facing output | `skills/output-renderer/SKILL.md` |

Do not load every capability file by default. Read only what the route needs.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

| compile final prompt | `skills/prompt-compiler/SKILL.md` |
| add pressure without over-contrarian behavior | `skills/pressure-strategy/SKILL.md` |
| review high-risk prompts | `skills/judge-review/SKILL.md` |
| format user-facing output | `skills/output-renderer/SKILL.md` |

Do not load every capability file by default. Read only what the route needs.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section '汉语语言学信号模式' defines intent-recognition behavior specifically around Chinese linguistic particles and states these signals are used in confidence scoring. The file does not offer user opt-in for language/locale handling or explain that this skill is intentionally limited to a Chinese-only context, which creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The intent table uses Chinese labels such as '理解', '决策', and '求助' while the surrounding documentation is in English, and there is no opt-in or explanation that the skill is region-specific. This can violate language/locale policy by imposing a specific language convention on users or downstream skill authors without choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown guidance switches into Chinese for substantial user-facing question templates and fallback text, while other parts remain in English. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The embedded prompt is written entirely in Chinese and requires the judge agent to produce its report in Chinese-formatted sections, but the file does not indicate that users are asked to opt into Chinese or that the skill is restricted to a Chinese-language context. This creates a language/locale policy issue because the skill imposes a specific language regardless of user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file hard-codes a Chinese default phrase ("默认答案压力测试") without indicating that language should follow the user's preference or the surrounding conversation. In a prompt-optimization skill, silently forcing output language can degrade usability, create confusing handoffs, and cause downstream prompts to be sent in an unintended language, especially when the user is interacting in another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Multiple "Ask first" examples are written only in Chinese, which implicitly constrains the interaction language despite the surrounding document being in English. This can violate language/locale policy because the file does not offer a language choice or document that the skill is intended only for Chinese-language use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file explicitly instructs the skill to persist cross-session preference and interaction history in a separate JSON file and reuse it on future invocations. For a prompt-improvement skill, this expands scope into user profiling and memory retention, creating unnecessary privacy and data-minimization risk if sensitive details are captured or later surfaced unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs persistent collection and storage of user interaction data but does not require a clear user-facing disclosure, consent flow, or retention explanation. This creates a transparency failure where users may not realize their interactions are being profiled and retained beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions explicitly tell the system to persist and reuse user choices and preferences across sessions. In a natural-language skill, this creates a retention and leakage risk because previously shared details may influence or appear in future outputs outside the user's current expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.