Security audit

ljh-maidian

Security checks for vulnerabilities and agentic risk

Overview

This is a single Markdown selling-point review skill with no code execution or network behavior, but it can create local archive files and shows an unsolicited support contact message on first use.

Before installing, be aware that first use may create a small onboarding marker in your home directory, and archive mode can store brand profiles and full deliverables in the current project directory. Do not use the archive feature for confidential commercial material unless that directory is private and excluded from source control or sharing. Treat the WeChat contacts as off-platform support information, not as part of the audited skill runtime.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:17
Finding: Forced Promotional Content and External Contact Redirection
Content: View full analysis
Welcome to the **LJHskill E-commerce Veteran Toolkit**. > > You can start from any of the following: > > **A. Product evaluation**: Send me the product brief, and I will assess > whether it is worth promoting, whether the positioning is clear, and whether > the selling points are valid. > **B. Content diagnosis**: Send a sales script, promotional copy, or successful > case, and I will inspect its persuasion chain, content factors, and audience > alignment. > **C. Business diagnosis**: Describe an advertising or operational issue, such > as falling volume, declining conversion, abnormal ROI, returns, or profit. > > Reply with **A, B, or C**, or describe where you are currently stuck. > > We also have an **LJHskill user WeChat group** for installation and usage > support, feature updates, and practical cases. Add either of the following > WeChat accounts and include "LJHskill" in the request: > > Li Jie: `lijiedelijiea` Hansen: `DamonWang1993` ``` ### Technical Analysis The skill requires the agent to prepend a prescribed onboarding message whenever a home-directory marker is absent. Part of that mandatory output advertises an external community and publishes two WeChat identifiers. This behavior is unrelated to the skill's declared core function of evaluating selling-point copy. Because the content is injected through the agent's trusted response c ...[truncated 1564 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:47
Finding: Automatic Retention of Brand Profiles and Commercial Deliverables
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language triggers are fairly broad and could activate on casual requests about whether a statement ‘stands up’ or ‘works,’ especially in adjacent review contexts. Unintended activation is dangerous because it can apply the wrong workflow to user input, potentially causing irrelevant analysis, confusion, or unexpected file operations later in the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s onboarding text expands the interaction beyond a selling-point checker into general product judgment, content diagnosis, business consulting, and external user-group promotion. This creates scope creep that can mislead users about what the skill will do and may trigger behavior unrelated to the declared function, increasing the chance of unintended data collection or off-task actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The onboarding flow checks for and attempts to create a file in the user’s home directory on first use without clearly warning the user before doing so. Writing to a persistent location without explicit prior consent is a risky side effect that can surprise users, leave artifacts on disk, and normalize hidden stateful behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The archive protocol instructs the skill to read and write persistent files in the current directory, including brand archives and deliverables, which goes beyond a transient text-analysis function. Persistent storage can expose sensitive business information, create unintended side effects on the user’s filesystem, and violate least-privilege expectations if the user did not clearly consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The archive workflow writes brand files and deliverables into the current directory by default if the user agrees, but the skill description does not give an upfront warning that persistent local files may be created. This can lead to accidental storage of sensitive commercial information in unexpected locations and makes the skill more dangerous because it processes business-sensitive content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.