Back to skill

Security audit

Personal Growth Advisor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward personal growth helper with no hidden network access, persistence, credential handling, or destructive behavior found.

Installers should expect a mostly Chinese-language experience and general self-improvement templates. The skill should not be treated as mental-health care, medical advice, legal advice, financial advice, or guaranteed career guidance.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description and feature list are written entirely in Chinese, which indicates a language-specific user experience. The file does not mention that Chinese is optional, nor does it offer an alternative language or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file presents core disclaimer text, example inputs, and expected outputs in Chinese, which can effectively force a specific language experience for users who did not opt into that locale. The policy requires flagging language or locale constraints unless the skill explicitly offers a choice or clearly justifies the locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents headings, descriptions, and usage guidance exclusively in Chinese, while also including English command tokens. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language descriptions and user-facing content that are primarily fixed in Chinese, such as the class docstring and method descriptions. Because the skill does not offer a language choice or explain a region-specific requirement, it appears to impose a specific language/locale on users contrary to the policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The argparse description and help strings are presented in Chinese, and the program's default sample goals and habits are also Chinese-language content. Since users are not given a way to opt into Chinese or select another locale, the skill's natural-language interface enforces a locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file presents the skill test content in Chinese while also including English labels, but it does not state that the language is optional or region-specific. Under the policy rule for language/locale, forcing or assuming a language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.