Security audit

Insurance Agent Intelligent Trainer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only insurance training reference skill with no tools or executable code, though users should treat its coaching examples as advisory and avoid entering real personal data.

Before installing, understand that this skill is training content, not a real insurance compliance system or product parser. Do not paste real customer PII, confidential policy files, or regulated business data unless your own environment and company policies allow it, and have licensed insurance or compliance staff review any scripts before use with clients.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest declares the skill as advisory-only with no executable code, but the body presents system behavior resembling real ingestion and analysis of documents, schedules, and performance data. This discrepancy creates a trust-boundary problem: reviewers or deployers may believe the skill is inert while users are encouraged to treat it like an operational processing system.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill makes strong safety and data-handling assurances in its security notice, but later describes workflows that appear to ingest documents, evaluate schedules, score interactions, and generate reports. Even if framed as conceptual, this mismatch can mislead users or integrators about what data processing occurs, causing unsafe deployment assumptions around privacy, logging, or human review.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file states that it will not automatically access, store, or process training data or personal information, yet the architecture and examples repeatedly involve agent profiles, daily schedules, client visit details, and assessment metrics. In an insurance context, that data can include regulated personal and business information, so contradictory claims can lead to accidental privacy violations or compliance failures.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The file presents the skill in both English and Chinese and heavily targets Chinese insurance-market context, but it does not explicitly state whether responses will adapt to the user's preferred language. Under the language/locale policy, skills should offer a clear language choice or opt-in unless the locale restriction is explicitly documented and justified.

Static analysis

No suspicious patterns detected.