Security audit

Underwriting Expert Digital Employee

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable Chinese insurance underwriting workflow guide with clear human-review and no-automation boundaries, though a few wording issues should be tightened.

Use this only in a controlled insurance underwriting setting. Provide the minimum necessary, desensitized customer and health data; keep final underwriting decisions, customer contact, sending, saving, and regulatory records under authorized human and institutional-system control. Clarify language/jurisdiction expectations if the workflow will be used outside Chinese-language insurance operations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description is entirely in Chinese and the skill body repeatedly specifies Chinese-language customer-facing artifacts such as Chinese notices and scripts, but does not offer a user-selectable language or locale option. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instruction requires outputs to be written in plain language, but throughout the skill the operational examples and communication templates are fixed to Chinese-language insurance workflows, with no explicit user choice of language. Because the skill does not clearly state that it is region-locked or require opt-in to Chinese output, this creates a locale-policy issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The end condition says '已完成联系' ('contact completed'), which contradicts the module's hard boundary that it does not contact customers. In agentic systems, contradictory instructions can cause orchestration layers or downstream implementers to treat the module as authorized to perform outreach, leading to unauthorized customer contact or policy bypass.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The module is documented as a notification-interpretation and notice-drafting workflow, not a customer-contact workflow, and the broader manifest repeatedly says customer contact is not automated by this skill. However, the line says that when systems are unavailable it should prompt personnel to obtain corresponding information from customers, which contradicts the module's own stated boundary that it should work from existing underwriting conclusions and related inputs rather than drive customer collection behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.