Security audit

ljh-liangye

Security checks across malware telemetry and agentic risk

Overview

The skill mainly does what it claims, but it also creates persistent local files and stores business materials in a project folder with limited upfront user control.

Review this skill before installing if you work in shared folders or handle confidential product, pricing, or influencer negotiation data. Use it only where creating ~/.ljhskill/onboarding.json and storing materials under ljh-档案/ is acceptable, and tell the agent not to use an archive if you want a one-off, no-persistence session.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest markets this as a pitch-material generator, but the instructions add persistent onboarding state and filesystem writes under the user's home directory. This is a scope mismatch that can surprise users and callers, because invoking a content-transformation skill also causes local state changes unrelated to the requested task.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill claims to only prepare meeting materials, but it also reads and writes a persistent brand archive and saves deliverables across runs. That expands the skill from ephemeral content generation into data retention and cross-session state management, increasing privacy and integrity risk if sensitive business information is stored without clear expectation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The onboarding message advertises unrelated diagnosis and community-promotion capabilities, which broadens behavior beyond the stated purpose of generating two-page host-meeting materials. While not directly code-execution dangerous, it can mislead users, trigger unnecessary data disclosure, and undermine least-privilege expectations for the skill.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The onboarding flow instructs automatic creation of a tracking file in the user's home directory on first use, without prior warning or explicit consent. Silent persistence violates user expectations and can be abused to leave state markers, create unwanted files, or normalize unauthorized filesystem side effects.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill automatically reads from and writes to `ljh-档案/` in the current directory, including brand archives and deliverables, without a strong upfront warning. Current-directory file operations can touch sensitive project data, create persistence artifacts, and unexpectedly mix business information into repositories or shared workspaces.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The archive instructions retain user-provided business information, conclusions, and deliverables across sessions and tools. Persistent storage of commercial strategy, pricing, and product details creates confidentiality and compliance risk, especially if stored unencrypted or in shared folders, and the cross-tool reuse increases the blast radius of any exposure.

Ssd 3

Low

Confidence: 90% confidence
Finding: Even though the onboarding file only stores a basic `onboarded` flag and timestamp, it still persists user state without explicit consent. This is lower severity than storing business content, but it remains a privacy and transparency issue because the skill silently tracks usage state across sessions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.