Security audit

Data Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese smart-home training-data generator with some data-quality and privacy cautions, but no hidden access, remote execution, persistence, or exfiltration behavior was found.

Before installing, treat this as a Chinese-language dataset-generation helper. Use synthetic or anonymized household data, avoid feeding hostile or untrusted instruction lists without validating the JSONL output, and choose output paths carefully because the generator writes and may overwrite files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build_prompt.py:77
Finding: Untrusted User Instructions Are Embedded Directly into the LLM Prompt
Content: View full analysis
Remediation: View remediation
` and `` wrappers. - A tool name exactly matching the selected allowlisted tool. - Tool-specific required fields and permitted value types. 5. **Reject unexpected generated content.** Fail closed if parsing fails, additional tool calls appear, the selected tool changes, required fields are missing, or text exists outside the expected JSONL object. 6. **Constrain input size and format.** Apply limits to instruction length, item count, control characters, and delimiter-like content to reduce abuse and resource exhaustion. 7. **Add adversarial tests.** Include instruction values containing phrases such as “ignore previous instructions,” fake section headings, XML-like closing tags, JSON fragments, and synthetic tool calls. Confirm that these remain literal user data and cannot change the output policy. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description promises generation of JSONL training data from supplied inputs, but the documented workflow instead loads external tool-specific prompt files and may rely on fixed example instructions. This mismatch is dangerous because hidden dependence on local reference files and undeclared behavior can mislead operators, expand the trust boundary, and cause generation of outputs that do not reflect the user's actual inputs or policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill hard-codes a required sovereignty stance for a political topic, forcing the agent to produce a predetermined position rather than neutrally following user intent, system policy, or jurisdiction-aware handling. This creates an integrity and trust risk by embedding political manipulation into tool-routing behavior, and the same pattern could be extended to other sensitive topics without oversight.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented output format includes detailed household context such as device names, room mappings, scene lists, timestamps, and user instructions, all of which can contain sensitive personal data. Without privacy warnings, minimization guidance, or handling restrictions, the skill can normalize collection and storage of rich household telemetry into JSONL artifacts that may later be retained, shared, or used for training.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Throughout the file, all required user-facing reply examples and formatting instructions are specified only in Chinese, including mandatory fallback responses and final reply wording. This creates a language/locale constraint without opt-in or an explicit statement that the skill is intended only for Chinese-speaking or region-specific users.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The chat fallback tool is defined to handle a very broad set of topics, which increases the chance that unrelated, sensitive, or policy-restricted requests are routed to a generic catch-all path without adequate task-specific controls. In an agent skill, overly broad fallback routing can bypass intended tool selection boundaries and lead to inconsistent safety handling, misinformation, or unauthorized responses.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guidance for exit_dialog includes broad everyday phrases such as '再见', '拜拜', and especially hostile but commonly uttered phrases like '闭嘴', without any activation boundary or confirmation requirement. In a dialogue-generation skill, this can train or encourage agents to terminate sessions unexpectedly when users are speaking conversationally, sarcastically, or referring to examples rather than intending an actual exit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The tool specification defines parameter formats and some field-filling rules, but it does not clearly constrain when the tool should or should not be invoked, how to validate ambiguous user intent, or what safety checks must occur before generating automation scenes. In a home-automation context, this ambiguity can cause the agent to create unintended scheduled or condition-triggered actions, especially when it is instructed to infer names, fill default times, or 'supplement local device XX' without explicit user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains substantial natural-language prompt content entirely in Chinese and prescribes exact output wording and format in Chinese, such as the required final reply and schema labels. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which it is not here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script's docstring, error messages, logs, and generated assistant utterances are all hard-coded in Chinese, with no option for the user to select another language. This is a natural-language policy concern because it imposes a specific language/locale without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language instructions and examples throughout the file are Chinese-only, which can amount to forcing a specific language without user opt-in. The file does not indicate that the skill is region-specific or that alternative language support is available.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Natural-language policy review applies to all file types. The instructions and trigger phrases are exclusively Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional and documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script overwrites or creates the path given by output_file using open(..., "w"), which is a file write operation. Although it is expected for a data-generation script to produce output, there is no explicit warning, confirmation, or comment/docstring near the write explaining that the destination file will be written and potentially overwritten.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.