Security audit

Fine-tune Service CN | 模型微调服务

Security checks for vulnerabilities and agentic risk

Overview

This is a visible commercial fine-tuning service, but it asks users to share datasets, contact details, and payment information with a third party without privacy or handling safeguards.

Review this carefully before installing or using it. Do not send confidential, proprietary, personal, customer, regulated, or legally sensitive datasets unless you have a separate agreement, a secure transfer method, and clear terms for access, retention, deletion, ownership, and payment disputes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The workflow explicitly asks users to provide datasets and contact details, states training will occur on the author’s local GPU, and lists external payment/contact channels, but it provides no warning about privacy, data ownership, confidentiality, or the risks of sending proprietary or personal data to a third party. In this context, users could disclose sensitive business documents, personal information, or regulated data without informed consent or safeguards.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger list includes very generic terms such as “微调”, “fine-tune”, “LoRA”, and “训练模型”, which can match many normal conversations and cause unintended invocation of this commercial skill. Because the skill solicits off-platform contact and transfer of datasets for local processing, accidental activation increases the chance users are nudged into sharing sensitive data or engaging with an unvetted third party.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The script's title and all user-facing messages are presented only in Chinese, including contact and pricing information. This imposes a specific language on users without any opt-in, fallback, or justification for a region-specific audience, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The package description labels the skill as a China-specific fine-tuning service ("CN") but provides no accompanying explanation that this locale restriction is optional or justified. Under the policy, locale-specific behavior should either be user-selectable or clearly documented as region-specific for a valid reason.

Static analysis

No suspicious patterns detected.