Security audit

Wanpaike Opc Business Model Analysis

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language business model analysis prompt with no code, persistence, credential access, or hidden data handling.

Install this if you want a Chinese-language framework for business model analysis. Treat its financial scoring and LTV/CAC outputs as advisory, since the results depend on the accuracy of the business data you provide.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L014-L020 将触发条件写为“用户需要设计或优化商业模式”“用户想评估商业模式可行性”等泛化意图，没有限定具体触发短语、使用场景或排除条件。这类描述覆盖面很广，容易与日常创业、咨询类对话重叠，增加非预期调用该技能的风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The user-facing natural-language instructions and description are presented exclusively in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: L200-L202 使用“想验证你的商业模式是否靠谱？”“让我帮你算算LTV/CAC”等自然口语化表述，接近日常交流措辞，但未说明这些是否为正式触发语或仅为营销文案。缺少明确边界时，可能被解释为可由类似普通表述激活。
Content: No source excerpt is available for this finding.