詹明明·我该卖什么

• Outcome: Review
• Latest audit: Sep 6, 2026 · 12:24 PM UTC
• Version: 0.2.6

Overview

This skill appears to be a legitimate product-advice workflow, but it relies on mutable external rule files and persistent memory in ways users should review before installing.

Install only if you are comfortable with this skill reading shared memory, relying on local vault rule files that may change its behavior, and saving product-strategy details across sessions. Review or restrict the referenced zmm, vault, and memory paths before using it with sensitive business plans.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:20
• Finding: Untrusted External Instructions Can Override Packaged Skill Rules<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-29`, `references/规则卡.md:4` **Vulnerability Type**: Instruction precedence assigned to mutable external files **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the relevant source segment: ```markdown First read `zmm/references/Family Covenant.md`. If it cannot be read, state that the covenant is unavailable and stop. Then read `zmm/references/Interaction Specification.md`. The built-in criteria are in `references/Rule Card.md`. If corresponding rule files exist in `{vault}`, the vault takes precedence and the rule card serves as the baseline. The following must also be read: - The "Bright Path in Three Acts" section from the external cognitive framework - The corresponding methodology chapter from `{vault}`, if present - The external cognitive framework itself ``` The rule card separately establishes the same precedence: ```markdown When corresponding rule files exist in `{vault}`, the vault takes precedence and this file is the baseline. If the two locations conflict, follow the vault first and then update this file. ``` ### Technical Analysis The packaged skill explicitly delegates part of its operational behavior to files outside the audited project. More importantly, it grants the mutable `{vault}` content precedence over the packaged rule card when the instructions conflict. The referenced covenant, interaction specification, cognitive framework, and vault rules were not included in the audited directory. Their integrity, provenance, permissions, and contents therefore could not be verified. Treating such files as authoritative instructions creates an instruction-hijacking boundary: anyone able to modify one of those files may change the skill's questions, output requirements, decision logic, or requested tool activity without modifying the reviewed package. The instruction to stop when the covenant is unavailable reduces one failure mod ...[truncated 1300 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle all mandatory behavioral rules with the skill and review them as part of the same release. 2. Pin external rule files by version or cryptographic digest and reject unexpected changes. 3. Treat vault and memory content as untrusted data rather than executable instructions. 4. Define an immutable precedence policy under which packaged safety constraints and tool restrictions can never be overridden by external files. 5. Allowlist exact external paths and reject symbolic links, path traversal, and files outside approved roots. 6. Validate external files against a restrictive schema that permits domain data but not new tool-use or policy instructions. 7. Record the source and version of every loaded rule file in the output or audit log. 8. Fail closed when a file fails integrity or provenance validation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:31
• Finding: Overbroad Shared-Memory Read and Persistent Write Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31`, `SKILL.md:241` **Vulnerability Type**: Excessive access to shared persistent memory **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the relevant source lines: ```markdown Then read memory under `config.paths.memory` from: - `zmm-product/` - `_general/` ``` ```markdown Before finishing, check which extraction direction the user rejected and record it as a correction. Record any criterion validated by real delivery as an effective method, including its result. Write these records under `config.paths.memory/zmm-product/` after checking for duplicates. ``` ### Technical Analysis The skill instructs the agent to read both a task-specific memory namespace and a shared general-purpose namespace. It also requires persistent writes containing user corrections and delivery-validation results. No field allowlist, consent requirement, sensitivity filter, retention period, ownership check, or session boundary is defined. Reading a shared namespace violates least-privilege principles when only product-extraction records are needed. It can also expose the current session to unrelated or attacker-controlled persistent text. The persistent write operation is narrower than the read operation, but it can still retain user-specific business information across sessions. Although the skill does not explicitly instruct the agent to write executable rules, stored free-form corrections or methods could later influence other sessions if subsequent skills interpret memory content as authoritative instructions. ### Attack Path 1. Sensitive, unrelated, or attacker-controlled content is stored in the shared general-memory namespace. 2. The product skill is invoked in a later session. 3. The skill reads the entire designated general namespace as part of its startup procedure. 4. That content enters the agent's working context and may influence product analysis or appear ...[truncated 949 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the default read of the shared general-memory namespace. 2. Restrict access to a dedicated, skill-specific namespace with per-user and per-session boundaries. 3. Request explicit user consent before writing persistent records. 4. Store only predefined structured fields, such as a non-sensitive direction identifier and validation status. 5. Reject secrets, credentials, personal data, raw conversation transcripts, and unrelated business details. 6. Treat all retrieved memory as untrusted data and prevent it from overriding system or packaged skill instructions. 7. Add ownership and authorization checks before every memory read or write. 8. Define retention limits and provide inspection, correction, and deletion controls. 9. Log memory access without recording the sensitive memory contents themselves. 10. Use deduplication only after authorization and sensitivity validation; deduplication alone is not a security control. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad natural-language phrases such as 'what should I sell' and 'how do I package what I know', which can plausibly appear in ordinary conversation. That increases the chance of unintended skill activation, causing the model to switch into this skill's workflow when the user did not explicitly ask for it, potentially changing behavior, scope, or data handling unexpectedly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to write interaction-derived information into persistent memory, but the visible skill description does not warn users that their responses may be stored. This creates a transparency and consent problem: users may disclose sensitive business plans, contacts, failed ideas, or strategic decisions without understanding that the information will persist beyond the session.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instruction explicitly requires persisting user-provided details such as rejected directions and validated methods into memory logs. Because this skill handles product ideas and business context, those logs may contain commercially sensitive or identifying information; persistent retention increases the blast radius of accidental disclosure, later misuse, or cross-session leakage.

Static analysis

No suspicious patterns detected.