Security audit

Cb Crisis Communication Protocol

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only crisis communication planning skill, with only a visible language-clarity issue in one example.

Safe to install as a planning aid. Before using it in a real crisis, specify the target market and output language, and have legal, regulatory, safety, or liability-sensitive statements reviewed by qualified professionals.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill embeds a Chinese-language scenario and expected output as a normal usage example without indicating that the language switch is optional or user-selected. This can cause the agent to produce output in an unexpected language, creating confusion, usability failures, and potential mishandling in time-sensitive crisis communications where precision and audience-appropriate language matter.

Static analysis

No suspicious patterns detected.