Back to skill

Security audit

Psych Quiz

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed mental-wellness self-check guide with no code execution, network access, persistence, or hidden system behavior.

Install only if you want lightweight self-reflection quizzes for stress, sleep, or emotional strain. Treat outputs as informal prompts for observation, not diagnosis or treatment advice; for severe distress, self-harm thoughts, safety concerns, or impaired daily functioning, use local emergency/crisis resources or a licensed professional.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing instructions, examples, and outputs are specified in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and region-specific. This can violate language/locale policy when a skill imposes a language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill performs mental-health self-assessment and interpretation, but the documented behavior does not clearly and prominently warn that the output is not a diagnosis and is not suitable for crisis, safety-sensitive, or clinical decision-making. In a mental-health context, users may over-trust simplified quiz outputs, delay care, or mis-handle urgent symptoms, which raises the risk beyond a generic content-quality issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed triggers include generic phrases such as "我最近状态怎么样", "做个心理小测试", and "sleep check", which overlap with ordinary conversation and are not tightly scoped to this specific skill. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not activate the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Examples and expected outputs switch between Chinese and English, including mixed-language phrases like "quick mental check-in," but the document does not state how the skill determines the response language. This can create an implicit language/locale policy issue if the skill answers in a language the user did not choose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.