Security audit

Qizheng Brand Marketing

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent brand-marketing package, but one bundled HTML page includes under-disclosed iframe inspection code that can report user hover and click details to a parent page.

Review before installing. The marketing guidance itself is generally coherent, but avoid embedding or opening the bundled index.html in sensitive contexts unless the iframe highlighter/telemetry code is removed or restricted to trusted origins. Do not put confidential budgets, crisis plans, staff contacts, customer data, or unpublished strategy into permanent public links without access controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This page is presented as a simple brand-marketing product page, but it contains a large iframe instrumentation script unrelated to that purpose. The script injects overlays, tracks hovered/clicked elements, and communicates element/page data to a parent window, which creates covert data-collection capability inconsistent with the declared skill context.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script collects element metadata including selector, text, attributes, URL, and geometry on hover, then posts it to window.parent using a wildcard target origin. In an embedded context, this can leak sensitive page content or user-visible data to any parent frame, far beyond what a marketing landing page should do.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The page accepts unauthenticated postMessage commands from the parent to enable highlighting, update selected elements, and control inspection state. This exposes a remote control surface unrelated to the business function of the page and can be abused for tracking, UI manipulation, or integration into broader inspection workflows without the user's knowledge.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The comments describe the code as an iframe highlighting helper, but the implementation also extracts text, attributes, selectors, URL, and interaction data and sends them to the parent window. This mismatch obscures the true behavior of the script and increases the risk of hidden telemetry or unauthorized data exposure.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad, generic marketing terms that are likely to appear in normal user conversations, which can cause unintended activation of this skill outside a clearly scoped context. Because the skill can steer outputs into structured marketing, promotion, and crisis-response workflows, accidental invocation may override user intent, expose unrelated conversation context to the skill, or produce inappropriate operational guidance.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The quick-call table maps very common phrases like '帮我做品牌定位' and '帮我制定推广方案' directly to full workflow execution, making accidental or overbroad routing highly plausible. In practice, this can cause the system to invoke the skill for ordinary brainstorming requests, leading to prompt capture by the skill and generation of consequential business recommendations without explicit user consent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The page transmits page and element data to a parent window without any user-facing notice, consent, or privacy explanation. Even if intended for debugging, undisclosed cross-window telemetry is inappropriate here and can expose page contents or interaction context to an embedding parent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Click events trigger collection and transmission of clicked-element content and metadata to the parent window without informing the user. In practice, this can reveal what the user interacted with and may disclose sensitive text or attributes if the page is embedded in a broader workflow.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: On load, the script sends the current page URL and user agent to the parent window without visible disclosure. While lower severity than element-text capture, it still creates undisclosed metadata leakage and helps fingerprint the environment of embedded users.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill explicitly states it can collect and organize client-related information from public channels, but provides no constraints on what data may be gathered, no privacy notice, and no guidance on lawful or ethical handling. In a marketing and profiling context, this can lead to over-collection of personal data, scraping of sensitive information, or downstream misuse in customer targeting and KOC profiling.

Static analysis

No suspicious patterns detected.