Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | [references/config/preferences-schema.md](references/config/preferences-schema.md) | EXTEND.md schema |
Security audit
panda-knowledge-card
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent knowledge-card image generation skill that uses local preference files and saves generated outputs, with no evidence of hidden, destructive, or exfiltrating behavior.
Before installing, be aware that this skill may create a persistent EXTEND.md preference file and save pasted source content, generated prompts, outlines, and images to disk. Avoid using it with confidential text unless you are comfortable with those local copies, and review any character image path you configure.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger list includes broad natural-language phrases such as '做成卡片' and '生成卡片', which can plausibly appear in ordinary conversation and cause unintended invocation. Accidental activation matters here because the skill can read local config and write outputs to disk, so a casual phrase may trigger side effects the user did not intend.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill writes source content, outlines, prompts, and generated images to disk, but the description does not clearly warn users about this persistence behavior before execution. If users provide sensitive article text or proprietary material, the skill may leave unexpected local copies and derivative artifacts behind.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill guidance is written as Chinese-only operational instructions, including user-intent patterns and output rules, with no indication that other languages are supported or that the user may opt into Chinese. This can constitute a language/locale policy violation because it implicitly constrains interaction to a specific language without documented choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The line specifies '英文优先' for X/Twitter as a default content-language preference. This is a natural-language locale policy constraint presented without offering a user choice or documenting a justified region-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The line states '英文优先' for Instagram, imposing a language preference as policy-like guidance. Because no opt-in, audience-based condition, or documented justification is provided, this conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all user-facing instructions and examples exclusively in Chinese, with no indication that the skill is region-specific or that users may choose another language. That can violate a language/locale policy when users have not explicitly opted into Chinese-only operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file is entirely written in Chinese and presents the style system as a general specification, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire workflow, prompts, status text, and user-facing interaction examples are specified only in Chinese, including required question content and completion reports. This effectively forces a specific language/locale for the skill experience without any opt-in, fallback, or explanation that the skill is intentionally region-specific.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill is presented as a straightforward content-to-card generator, but its workflow makes local configuration discovery a blocking prerequisite and can divert the agent into setup behavior unrelated to the immediate request. This creates unnecessary file-system interaction and increases the chance of surprising access to local files without clear upfront disclosure.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to probe multiple project/user-level paths for EXTEND.md and then read and summarize the file before doing its main task. That expands data access beyond what is strictly required for basic card generation and can expose unrelated local preferences or sensitive notes if those files contain more than expected.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file is written entirely in Chinese and presents prompt templates and card instructions only in that language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative language choice or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file instructs the skill to save a new EXTEND.md file in either a project path or a global user-directory path and only specifies a success confirmation afterward. It does not warn the user beforehand that the operation will create or overwrite a persistent configuration file, which is a user-data/system-affecting behavior covered by the missing-warning rule for markdown files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document is entirely written in Chinese and the schema's example values center on Chinese labels and locales, which can amount to forcing a specific language context if this skill is used more broadly. While
语言: autois allowed, the surrounding documentation does not clearly state that users may choose their preferred language before use.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese and does not indicate that language selection is optional or region-specific. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.