Security audit

AI KEY·大客户会不会跑

Security checks for vulnerabilities and agentic risk

Overview

This business-analysis skill is coherent and not malicious, but it stores and reuses sensitive customer and revenue observations across sessions without clear user consent or retention controls.

Review before installing if you discuss real customer names, revenue amounts, payment behavior, or channel dependence. Prefer using anonymized customer labels and ensure you are comfortable with this skill reading and writing AI KEY memory across sessions; avoid it for highly confidential accounts unless memory use is explicitly controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill directs persistent storage of sensitive business intelligence, including loss indicators, customer-risk signals, strategy corrections, and business-specific concentration patterns, without a clear retention warning or consent step. This creates a meaningful confidentiality risk because the stored data could later be surfaced unexpectedly, accessed by other workflows, or retained longer than the user realizes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases such as questions about customer concentration that are plausible in ordinary conversation, which can cause accidental invocation outside the user's intent. In a business-analysis skill, unintended activation can expose sensitive revenue, customer, and dependency discussions to the skill workflow and its memory routines without the user explicitly choosing this tool.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to read persistent memory containing business data before analysis, but does not clearly warn the user that prior customer and revenue-related information may be accessed and used. Because this skill handles commercially sensitive information, silent retrieval from memory increases privacy and confidentiality risk, especially if users do not expect retention across sessions.

Static analysis

No suspicious patterns detected.