Security audit

AI KEY·戳不戳得中人

Security checks for vulnerabilities and agentic risk

Overview

This is a content-analysis skill with no executable code; its main caution is that it can read and write scoped AIKEY memory files.

Install this if you want a Chinese-first AIKEY content resonance reviewer. Before using it, decide whether you are comfortable with it reading AIKEY reference/memory files and saving small memory notes about corrections or validated content-performance patterns.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list contains broad natural-language phrases such as 'why did this blow up' and similar everyday wording that can match ordinary conversation outside the user's intent to invoke the skill. Unintended activation can expose user content to the skill's custom instructions, including its memory-writing behavior, causing surprise, misrouting, and possible data handling the user did not expect.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The instruction says "跟用户说话时只说人话，不说理论名" in a fully Chinese-only skill specification, with no indication that users may choose another language. Given the bilingual header and triggers, the file presents the skill as generally usable but does not offer language or locale opt-in, which can violate language-choice policy.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as an analysis/diagnosis tool, but it also instructs the agent to write persistent memory entries based on user interactions and inferred outcomes. That creates an unexpected stateful side effect: sensitive user content, corrections, and performance data may be retained beyond the session without clear consent or minimization, increasing privacy and prompt-persistence risk.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This markdown skill content forces a specific language for all instructions and outputs, which can violate language/locale policy when no user opt-in or region-specific justification is provided. The file contains no indication that Chinese is optional or that the skill is limited to a Chinese-speaking context.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This markdown file is entirely framed in Chinese from the title onward, and it does not state that the skill is region-specific or give the user a choice of language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.