Security audit

AI KEY·风口在哪

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trend-analysis skill with some local memory/reference updates that users should understand, but no evidence of hidden, destructive, or credential-seeking behavior.

Before installing, decide whether you are comfortable with the skill saving trend judgments and outcomes in local memory and appending proven missing variables to its reference file. Avoid using it for direct stock, crypto, fund, or other financial buy/sell decisions; the skill itself says it does not provide investment advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The listed triggers include broad natural-language phrases such as “这是不是风口”, “下一个机会在哪”, “现在入场晚不晚”, and “am I too late”, which are common conversational questions and not narrowly scoped commands. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not invoke this skill, increasing the risk of unintended activation.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill stores user judgments, outcome-tracking data, and inferred metadata in memory despite presenting itself as an analysis aid rather than a persistence-heavy workflow. This creates a privacy and scope-creep risk: sensitive strategic beliefs, career plans, or behavioral patterns may be retained longer than users expect, and the stored inferences can later influence other interactions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill authorizes writing back to an internal shared reference file (`references/硬变量库.md`) based on conversational outcomes. A user-facing reasoning skill should not be able to modify shared knowledge artifacts without strong validation, because poisoned or low-quality updates could affect future users and create cross-session prompt/data contamination.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Line L003 states '跟用户说话一律说人话', and the entire document is written as a Chinese-language operating reference for executors. This imposes a language/locale expectation without any visible user opt-in or documented justification that the skill is region-specific, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The instruction says to speak to users only in plain, non-technical language, and later reinforces “零术语,” which imposes a fixed communication style. While not a severe issue, this can conflict with language/locale-style preference expectations because the skill does not offer the user an option to receive more technical terminology if preferred.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown content forces a specific language throughout without any opt-in, alternative language, or stated justification for a language-specific audience.

Static analysis

No suspicious patterns detected.