Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | Full design document (this file) |
Security audit
Dianping Restaurant Guide
Security checks for vulnerabilities and agentic risk
Overview
This is a China-focused restaurant review analysis skill with a local sample-data CLI and no evidence of hidden execution, credential access, persistence, or data exfiltration.
Before installing, treat it as a China/Dianping-oriented helper and note that the documentation's future scraping/cache language should be clarified if used with real public review data. The current packaged script is local and sample-data based, with no credential use or write actions found.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that scraped review data is 'never stored beyond session', but elsewhere documents caching data for 1 hour and using cached data when scraping is blocked. This is a real data-handling inconsistency: operators or users may rely on stricter privacy guarantees than the implementation actually provides, leading to undisclosed retention of scraped content and metadata.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains extensive hard-coded Chinese phrases, keywords, sample data, and CLI defaults tailored to Chinese-language input and Shanghai-specific output. Because the skill does not provide a documented language or locale choice, it effectively forces a specific language/locale behavior, which matches the policy-violation category for language or locale constraints without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The document consistently uses Chinese inputs, Chinese output examples, and Chinese keyword-based sentiment logic, but it does not explicitly state that users may choose their preferred language or that Chinese is required for a justified region-specific reason. This can be read as forcing a specific language/locale without opt-in.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The sample prompts and first-success path show many natural-language ways to invoke the skill, but the document does not define a bounded trigger set or clarify when these phrases should or should not activate the skill. This can make activation scope ambiguous because common recommendation-style requests could overlap with ordinary conversation in a broader assistant context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file includes a hard-coded list of generic phrases entirely in Chinese, which suggests the skill's fake-review heuristics are tailored to a specific language without documenting user opt-in or regional scope. Under the natural-language policy rules, forcing a specific language/locale without choice or justification is a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This manifest-like JSON schema includes natural-language descriptions that assume a Chinese locale, using only Chinese location examples and CNY as the budget unit. Because the file does not document that the skill is region-specific or offer any locale choice, it can be read as imposing a specific language/locale by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON schema file includes natural-language enum values for meals that are fixed to English only. Because SQP-3 applies to all file types, this can be considered a locale/language policy concern when the skill otherwise appears tied to a Dianping restaurant context and the schema provides no user opt-in or documented locale rationale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill is framed around Dianping and its example commands require Chinese text such as '川菜' and '老王川菜', which indicates a fixed language/locale expectation. The file does not state that the skill is China-specific by design or offer any language choice, so this appears to be an implicit locale restriction in natural-language content.
- Content
Static analysis
No suspicious patterns detected.