Back to skill

Security audit

Opc Live Compliance

Security checks for vulnerabilities and agentic risk

Overview

This compliance-branded livestream skill is documentation-only, but it mixes compliance checks with sales scripts that encourage urgency, scarcity, social pressure, and unsupported claims.

Review this skill carefully before installing. It does not appear to compromise the local system, but a user asking for compliant livestream content could receive templates that create consumer-protection, platform-enforcement, or advertising-compliance risk unless all scarcity, social-proof, health, price, and inventory claims are verified and the stricter compliance checklist is treated as authoritative.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:266
Finding

Livestream Templates Encourage Unverified Scarcity, Social-Proof, and Health Claims

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 266, 287, 340, and 361–362
Vulnerability Type: other: Deceptive Content Generation Guidance
Risk Level: Medium

Evidence

The following is a faithful English rendering of the relevant content:

markdown
| **Order-closing script** | Hunger marketing, scarcity plus reassurance | Countdown plus after-sales assurance | "Only 10 orders left! Removed in 30 seconds! Customers who ordered, reply 'ordered'." |

Example: "I actually used an XXX product, which guarantees that you can enjoy food without gaining weight."

| **Scarcity and reassurance** | "Place your order quickly" | "Only the final 20 orders remain! Five hundred customers have tried it for you. What are you waiting for?" | Social proof plus scarcity |

| Does it contain S-level prohibited terms? | Absolute or false promises | Must contain zero |
| Does it contain inducement language? | Time-limit, quantity-limit, or price-increase threats | Must contain zero |

Technical Analysis

The Skill is documentation rather than executable software, so this issue does not provide code execution, elevated privileges, persistence, credential access, or direct system compromise. The risk arises when an AI agent treats the supplied examples as approved, reusable livestream templates.

The templates encourage claims involving exact remaining inventory, short removal deadlines, exact customer counts, and a guaranteed weight-related outcome. The Skill does not require these claims to be validated against an authoritative inventory system, sales records, campaign configuration, or substantiated product evidence before use.

The guidance is also internally inconsistent. Lines 361–362 require generated scripts to contain no false promises and no inducement based on time limits, quantity limits, or threatened price changes, while lines 266, 287, and 340 explicitly recommend those patterns. An agent following the ...[truncated 1413 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the guaranteed weight-related outcome and replace it with language that does not claim an unsubstantiated health effect.
  2. Replace hard-coded scarcity, deadline, and customer-count examples with parameters such as verified inventory, verified campaign end time, and verified completed-order count.
  3. Require each factual sales claim to include a trusted data source and a freshness timestamp before it can be inserted into generated content.
  4. Prohibit the model from inventing inventory levels, sales totals, customer counts, discounts, deadlines, or product outcomes when verified data is unavailable.
  5. Apply the prohibited-language and inducement checks to every generated script, including examples sourced from the Skill itself.
  6. Configure the compliance stage to block output rather than merely warn when it detects guaranteed outcomes, fabricated scarcity, or unsupported social proof.
  7. Add category-specific review for health, cosmetic, food, and weight-management products.
  8. Add regression tests demonstrating that the templates on lines 266, 287, and 340 are rejected unless their factual elements are verified and legally permissible.
  9. Resolve the contradiction between the sales templates and the zero-tolerance requirements on lines 361–362, making the compliance requirements authoritative.
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill presents itself as a compliance tool, then later introduces sales scripts that include prohibited or manipulative tactics such as false expertise cues, exaggerated efficacy, urgency, scarcity, and social-pressure patterns. In a compliance-branded skill, this contradiction is dangerous because users may trust the later guidance as approved, causing policy violations, deceptive marketing, and account or platform enforcement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The self-checklist explicitly says urgency, scarcity, and threat-based inducement must be absent, but adjacent sections instruct the operator to use exactly those mechanisms like countdowns, low-stock pressure, and crowd-cue manipulation. This creates a direct policy bypass pattern where the document appears compliant on paper while operationally teaching users how to violate the same guardrails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file is written entirely in Chinese and presents all operational guidance, templates, and user-facing examples only in Chinese, with no indication that users may choose another language. Under the policy rule for language or locale, this is a natural-language constraint that should either provide opt-in/choice or clearly justify that the skill is region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill scope drifts from compliance assistance into a broad playbook for persuasion, conversion optimization, traffic operations, and full closed-loop live-commerce automation. This is risky because a user seeking safe compliance help may instead receive mixed-purpose content that normalizes aggressive or misleading growth tactics under the authority of a compliance skill.

Content

No source excerpt is available for this finding.