Security audit

胡田 OPC导师项目全流程管理

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed project-archive workflow that stores project inputs and outputs locally, so it should be used with sensitive-business-data care but does not show malicious behavior.

Before installing, confirm that users are comfortable with project prompts, outputs, logs, and migrated project materials being saved into local archives. Avoid putting secrets, raw customer personal data, or confidential contracts into the workflow unless the archive location and access controls are appropriate.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly states that every skill invocation's input/output will be recorded into persistent project archives, but it does not require user consent, visibility into what will be stored, or any minimization of sensitive content. In a project-management context, inputs and outputs are likely to contain business plans, diligence materials, stakeholder identities, or other confidential data, so automatic retention materially increases privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Persistent natural-language logging of every interaction's inputs and outputs creates a broad data-retention surface that can capture secrets, commercially sensitive information, personal data, and internal deliberations. Because the archive is designed as a central project record and shared workflow artifact, the context makes accidental overcollection and later disclosure more likely, not less.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The stage workflow directs the system to record input data, execution logs, and output artifacts into project files as part of routine operation. In this skill's context, those records can include diligence findings, contracts, customer requirements, and internal notes, creating a meaningful risk of sensitive information being duplicated and exposed across multiple files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The initialization flow instructs the agent to create archive directories, migrate existing materials, and extract prior project data into new files without warning the user that local files will be modified or that historical content may contain sensitive information. This can lead to unintended persistence and propagation of confidential data from pre-existing documents into broader archive structures.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Bulk extraction from existing project files into new archives semantically broadens access and retention of prior information without any privacy gate, need-to-know filter, or source-data review. This is dangerous because legacy folders may contain sensitive materials unrelated to the new archive's audience or retention scope, causing inadvertent data leakage and over-retention.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire template, including headings, field labels, and usage description, is written exclusively in Chinese, which implies the skill produces or expects Chinese-language content by default. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该技能的名称、描述与全文操作说明均仅以中文给出，且没有说明可根据用户偏好切换语言或提供多语言支持。按规则，若技能在自然语言层面默认强制特定语言而未提供用户选择，属于语言/locale 策略违规。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill defines broad bidirectional data flows involving customer information, project status, cost records, credit data, and knowledge-base archival, but it does not specify consent, minimization, retention, masking, or access controls. In a project-lifecycle skill that centralizes sensitive operational and client data, this omission materially increases the risk of privacy violations, excessive data propagation, and downstream leakage across connected systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automatic project creation, alerting, and knowledge-base output without clearly warning operators that these actions may trigger external side effects such as record creation, notifications, or irreversible dissemination of project data. In this context, automation tied to multiple systems can cause unintended disclosure, noisy notifications, or inaccurate records if triggered without confirmation or visibility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document describes broad bidirectional syncing among customer, finance, delivery, supply-chain, and knowledge systems, but does not specify consent, minimization, sensitivity handling, or access restrictions. In a project-lifecycle skill, this is more dangerous because the aggregated dataset includes customer contacts, project status, financial data, and performance records, increasing exposure if overshared or misrouted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The IMA knowledge-base sync exports project summaries, best practices, technical documents, templates, and even customer information with only a brief note that customer data is 'desensitized,' but no enforceable process or warning is defined. In this context, knowledge-base export can easily leak confidential client information, proprietary deliverables, or internal operational insights into a broader repository where reuse and access spread rapidly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill embeds authority to invoke Hermes GEPA and skill_manage(create/patch) to create or modify other skills, which is a privileged meta-capability unrelated to ordinary project recordkeeping. In a project-management context, this expands scope from passive tracking to code/behavior evolution, creating a pathway for unintended propagation of bad logic, privilege abuse, or adversarial prompt-derived changes across the wider skill ecosystem.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section routes routine project data, pain points, and retrospectives into an external self-evolution pipeline, normalizing automatic transformation of operational observations into skill changes. That is dangerous because project content may contain untrusted or manipulated inputs, and feeding them into an evolution engine can turn ordinary business data into instructions that alter system behavior beyond the skill’s stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing documentation is entirely in Chinese, including the title, usage instructions, and platform guidance, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language description and operational content enforce a single language context throughout the skill. Under the language/locale policy, this can be a violation unless the skill explicitly offers opt-in language selection or documents that it is intended only for a specific language or regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing operational instructions only in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rules, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file content, headings, and prescribed template fields are entirely in Chinese, which constitutes a natural-language locale constraint. The template does not indicate that users may choose another language or that the Chinese-only format is required for a documented region-specific process.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.