Security audit

Household Airflow Comfort Map

Security checks for vulnerabilities and agentic risk

Overview

This prompt-only skill does not run code, but its examples contradict its safety limits by giving HVAC, air-quality, window-use, and product advice.

Review carefully before installing. The skill has no code-execution or data-access risk, but users could receive unsafe or overconfident home ventilation, HVAC, air-quality, or product advice unless the examples are rewritten to match the stated comfort-only limits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

Confidence: 98% confidence
Finding: Across multiple examples, the markdown trains the model to exceed its declared safety boundary by offering diagnostic, product, energy-analysis, and air-quality advice without warnings. Example sections are high-influence prompt content; conflicting examples can override safer prose and cause the agent to generate harmful or unauthorized guidance in real use.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The Chinese example includes unsafe and out-of-scope guidance: advising window opening while AC runs, asserting CO2 as the cause of symptoms, recommending purifier use for CO2 removal, and suggesting product purchases. This conflicts with the skill's own safety boundary and could lead users to follow incorrect air-quality or health-related advice in potentially hazardous situations.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The acceptance test requires the skill output to be 'English-first with no CJK text,' which imposes a language restriction without any user opt-in or accessibility justification. While not a classic exploit vector, this is a genuine policy/security concern because it can cause exclusionary behavior, override user preferences, and encourage the agent to suppress or mistranslate user-provided multilingual safety-relevant context.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill description is written as an instruction in Chinese and does not indicate that the user can choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README examples expand the skill from a comfort-mapping tool into HVAC and indoor-air-quality advice, including outlet obstruction diagnosis, pressurization/ventilation tactics, and claims about reducing CO₂. That scope drift can cause users to rely on unqualified environmental or health-related guidance, increasing the risk of unsafe actions or delayed professional help.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README markets the skill as safety-bounded and excluding unsafe window use, but the examples recommend specific window-opening and fan-direction actions, including leaving windows cracked while AC is running and using windows for pressure-driven exchange. This contradiction can mislead users into treating the skill as authoritative for potentially unsafe household ventilation decisions despite the stated limitations.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The example output directly contradicts the stated safety boundary by diagnosing a likely HVAC cause ('vent is farthest' and 'partially blocked') and recommending equipment changes such as a vent booster fan. Even if presented as an example, downstream agents may imitate this behavior and provide repair-adjacent advice outside the intended comfort-only scope.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: This scenario expands the skill into energy-bill analysis, savings estimation, and emissions calculation, which are outside the documented output format and purpose. Scope drift like this can cause the agent to ignore constraints and produce unsupported financial or efficiency claims that users may rely on.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The skill includes a usage scenario entirely in Chinese and the expected output is explicitly framed for '中国常见户型' with China-specific shopping and operating guidance. This introduces a locale/language constraint in the skill examples without stating that the user chose that language or that the skill is limited to a China-specific audience.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The manifest sets the skill language to "en" with no indication that users may opt into another language or that the English-only constraint is required for a region-specific purpose. Per the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The trigger keyword "comfort routine" is generic and not clearly limited to airflow or stuffy-room use cases. In a manifest file, such a broad phrase could match ordinary requests unrelated to this skill and lead to unintended invocation.

Static analysis

No suspicious patterns detected.