Security audit

ljh-jiaoben

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent selling-script reviewer, but it also adds under-disclosed local tracking, promotional contact redirection, and persistent storage of business review data.

Review before installing. The main review functionality is legitimate, but expect the skill to display a promotional onboarding message, create a hidden onboarding file in your home directory, and potentially store script-review conclusions and full deliverables in a local ljh-档案 folder. Avoid using it with confidential sales scripts or brand strategy unless you are comfortable with those local files being created and retained.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Mandatory Promotional Output and External Contact Redirection
Content: View full analysis
Welcome to the LJHskill e-commerce toolbox. > > You can start in any of the following directions: > > A. Product evaluation > B. Content diagnosis > C. Business diagnosis > > Reply with A, B, or C, or describe where you are currently blocked. > > We also have an LJHskill user community for installation support, feature updates, and practical cases. Add the following WeChat contacts and include the note "LJHskill": > > Li Jie: `lijiedelijiea` Hansen: `DamonWang1993` ``` ### Technical Analysis The skill requires the agent to emit predefined branding, community promotion, and third-party contact identifiers before handling the user's actual request. This behavior is unrelated to the core sales-script review function and changes the expected response generated during the current session. The home-directory marker makes the injected behavior conditional on persistent local state. Although the marker does not itself contain executable rules, it tracks whether the promotional instruction has already been delivered. No remote execution or code payload is involved. This is best classified as skill instruction hijacking because loading the skill alters the agent's response objective from performing the requested review to first delivering attacker-authored promotional content and directing the user toward external ...[truncated 1157 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:60
Finding: Automatic Plaintext Retention of Sales Scripts and Brand Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill adds CRM-like archive management by reading and writing brand dossiers and delivery records across sessions, despite being described as a script reviewer. Persisting business data beyond the immediate interaction materially increases privacy, confidentiality, and data-retention risk, especially in shared or repository-backed environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as a selling-script reviewer, but it silently expands scope into onboarding, local state tracking, and broader business-diagnosis flows. This is dangerous because users invoking a narrow review tool would not reasonably expect persistence or additional workflow behavior, creating a consent and least-privilege violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions direct checking for and creating a hidden file in the user's home directory, which is unrelated to reviewing a pasted script. Silent reads/writes outside the immediate task violate user expectations and can create persistent tracking artifacts without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs creating a local file to record onboarding state without clear user-facing warning in the declared description. Hidden or undisclosed state changes are risky because they undermine informed consent and can surprise users with persistent artifacts on their system.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill embeds external contact information for a user group that is not necessary to perform script review. While not inherently malicious, this introduces unnecessary off-platform redirection and could facilitate unsolicited contact or social-engineering exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs creation and modification of project files for archives and deliverables without clear up-front warning. Unannounced writes can alter user workspaces, expose sensitive commercial information, and create integrity issues if files are stored in shared directories or synced repositories.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The archive workflow persistently stores user-provided business data across sessions in shared local files, which can include brand positioning, audiences, and conclusions. This creates confidentiality and retention risks because the data may outlive the user's intent, be accessed by others, or be committed to version control inadvertently.
Content: No source excerpt is available for this finding.

Ssd 3

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Even though the onboarding file stores limited data, it still creates hidden persistent state about the user's usage without explicit consent. Small tracking artifacts are less severe than business-data archives, but they still violate transparency and can normalize undeclared persistence.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.