T01 · Skill Instruction Hijacking
Error
- Location
assets/report_template.py:211- Finding
Mandatory Third-Party Branding in Customer-Facing Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
胡开奕 · 养老与传承顾问技能 · 风险评估报告
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed local report generator for Chinese retirement and inheritance risk reports, with privacy and dependency caveats but no evidence of hidden, destructive, or exfiltrating behavior.
Install only if you want a Chinese, Qingliu-branded retirement and inheritance risk-report template. Use a private working directory, review or pin the Python dependencies, avoid running it with elevated privileges, and check the generated report for sensitive personal information before sharing it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
manifest.json:12- Finding
Unpinned Third-Party Runtime Dependencies
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: Pillow== --hash=sha256: ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Pin relevant transitive dependencies through a lock file generated by a dependency-management tool. 5. Use the official package index or an authenticated internal mirror with controlled synchronization. 6. Run dependency vulnerability and license scans in continuous integration. 7. Update dependencies through a reviewed process rather than resolving unrestricted latest versions during deployment. 8. Install and execute the generator in an isolated virtual environment under a non-privileged account. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
assets/report_template.py:260- Finding
Predictable Output Paths Permit File Overwrite and Symlink Redirection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation text is written as a fixed Chinese prompt and instructs generation of a specific Chinese-language report format, with no indication that other languages are supported or that the user can opt in to this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file specifies '字体 | 微软雅黑', which imposes a Chinese-localized presentation convention and, together with the fully Chinese output structure, does not offer any user opt-in or alternative locale. Under the policy rule, forcing a specific language/locale without user choice can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s natural-language content and presentation are hard-coded for Chinese output, including a Chinese-only report title/content and a fixed Chinese font (
微软雅黑). There is no user-facing opt-in or documented justification that this skill is intended only for Chinese-language/regional use, which creates a locale policy concern under the rule.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code generates and saves a DOCX report and PNG family diagram containing highly sensitive personal and financial data, including health status, family relationships, assets, and inheritance intentions, to predictable local filenames without any privacy warning, consent gate, or output-path safety controls. In this skill context, that is more dangerous because the entire purpose is to process养老/传承 interview records, which are exceptionally sensitive and could be exposed through shared machines, synced folders, backups, or accidental reuse of the same filenames.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list contains several generic phrases such as '生成风险评估', '风险分析报告', and '养老风险盘点' that are broad enough to match user requests outside the intended narrow skill scope. This can cause unintended invocation, leading the agent to activate on loosely related finance or eldercare conversations and expose users to inappropriate automation in a sensitive wealth-management context.
- Content