Tech Doc Writer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.3.4

Overview

This skill is a Chinese technical-document writing guide with disclosed research and validation steps, and it does not contain hidden code, persistence, credential handling, or destructive behavior.

Install this if you want a Chinese-oriented technical documentation writer that may browse reference material and run simple local checks on generated Markdown. Provide trusted URLs, avoid asking it to process sensitive private documents unless needed, and state your preferred output language if you do not want Chinese.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest says the skill should be used for deep learning, machine learning, 'or any technical topic' and also for requests for 'comprehensive technical documentation', which is broad enough to overlap with many ordinary documentation or note-taking requests. It does not provide exclusion conditions or clear limits on when the skill should not activate, increasing the chance of unintended invocation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to fetch arbitrary reference URLs and cross-check with external documentation, surveys, and GitHub lists. That expands the skill from pure content generation into network access and ingestion of untrusted external content, creating prompt-injection and data-exfiltration risk if a malicious URL or hostile page is supplied.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill requires executing shell-style grep commands to validate generated files, which moves the skill into command execution and filesystem inspection beyond documentation writing. If followed literally by an agent with shell access, this normalizes command use on local files and increases risk from path manipulation, unintended file access, or chaining with other injected instructions.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The markdown explicitly requires code examples to use Chinese comments, which imposes a specific language choice on outputs. The file does not indicate this is optional or based on user preference, so it creates a language-policy issue for users expecting another language.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The checklist again directs grep-based scanning of generated files, reinforcing a pattern of filesystem and command interaction unrelated to the declared writing function. Repeated operational instructions like this enlarge the attack surface by encouraging agents to inspect local artifacts and execute host-level commands on potentially attacker-influenced filenames/content.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest presents the skill as a technical document writer, but this instruction specifically calls for reading current system time to judge whether source material is outdated. While freshness checking can improve output quality, accessing runtime/system context is an extra capability not described as part of the skill's purpose.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: This markdown file is natural-language instructional content and appears to force a specific language/locale for all readers. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified regional limitation, which is not present here.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file is entirely written in Chinese and presents the skill's writing style as if that language choice were fixed, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.