VOC Growth Report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.1.0

Overview

This skill is coherent for comment-analysis reporting, but it handles personal social-media export data and encourages saved reports/local previews without enough privacy and exposure controls.

Install only if you intend to process social-media comment exports and are comfortable managing personal data in those exports. Before using it, redact or minimize IP addresses, user IDs, user profile links, and quoted private or sensitive comments unless they are necessary; keep generated HTML reports local or access-controlled; and ensure any Feishu/Bitable storage has proper permissions and retention limits. If requesting a preview link, have the agent bind it to localhost and stop the server after review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listing explicitly describes ingestion and analysis of exported comment CSVs containing fields such as user IDs, user links, usernames, IP addresses, and quoted comment content, but it provides no warning, minimization guidance, or handling constraints for personal data. This can lead users to process and potentially redistribute sensitive data in reports or Feishu/Bitable workflows without considering privacy, consent, or regulatory obligations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description uses very broad activation criteria such as general analysis, reporting, HTML delivery, and growth recommendations, which can cause the skill to trigger for loosely related requests outside its intended CSV/VOC scope. Over-broad routing is dangerous because it can override more appropriate skills or cause unintended file/report workflows to run on unrelated user tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is designed to ingest comment-export fields that may include usernames, user IDs, user links, IP location, timestamps, and quoted comment content, but it contains no privacy guidance, minimization rules, or warnings about handling personal data. In this context, the omission is significant because social-comment exports can contain directly identifying or linkable information, and the workflow further encourages downstream reporting and Feishu/Bitable import, increasing persistence and spread of sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to generate files, start a local static preview service, and return a preview link/path, but provides no requirement for user consent or warning about creating local artifacts and exposing a listening service. This is risky because file creation and local server exposure change the execution environment and may unintentionally disclose sensitive report contents to other local users or processes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger examples combine highly specific phrases with broad intents like making a report for the boss or doing VOC analysis, without requiring confirmation that the input is actually a supported social-comment export workflow. This increases the chance of accidental activation and misrouting, especially in environments with multiple overlapping analysis or reporting skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt text is entirely in Chinese and implicitly requires the skill behavior to operate in Chinese, but the file does not indicate that language choice is optional or that the skill is intentionally region-specific. This creates a natural-language policy concern because it bakes in a locale/language constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompts on these lines are also written solely in Chinese and direct behavior around Chinese-platform comment analysis, but the file provides no explicit statement that the skill is region-specific or that users may select another language. Under the stated policy, forced language/locale assumptions should be documented or made optional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The prompt explicitly instructs the agent to write an HTML file to local storage and start a local preview/static server, but it does not require user confirmation, disclose that files will be created, or bound the serving behavior. In an agent setting, this can cause unauthorized filesystem changes and unnecessary network/service exposure, especially if the user only asked for analysis rather than execution-oriented delivery steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example output is presented as a Chinese-titled report derived from a Xiaohongshu export, which suggests a language/locale expectation in the skill’s demonstrated behavior. Because the file does not indicate that Chinese output is optional, user-selected, or justified as a region-specific skill, it may conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/demo-output-summary.md (reported line 20)May include surrounding context.

md

- CEO summary with next-7-day actions.

## Why this matters
This demonstrates that the skill is not limited to theory, schema design, or prompt-writing. It can support the full practical path from exported comments to a stakeholder-facing report artifact.

## What the demo proves
- real CSV fields can be parsed into a usable analysis workflow,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains required section headings in Chinese alongside English guidance, which effectively imposes a mixed language/locale format on report output. The file does not state that this is optional, user-selected, or required for a specific regional context, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains user-facing schema content where core labels are in Chinese while section headings and operational rules are in English. Because the skill does not state that it is intended only for Chinese-speaking users or provide an opt-in language choice, it may violate the language/locale policy requiring either user choice or a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The operative prompt content is entirely in Chinese and fixes the report title/content to Chinese-specific wording, which can impose a language choice on users without explicit opt-in. The policy calls for flagging language or locale constraints when they are forced rather than user-selected or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.