Security audit

Cross Verify

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only fact-checking skill that may use web search for pasted claims, with no code execution, credentials, persistence, or hidden behavior.

Install this if you want structured fact-checking, bias detection, and logic analysis. Be aware that using it may cause the agent to search the web for claims in pasted text, so do not paste confidential or sensitive material unless that browsing behavior is acceptable.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is broad enough to activate on many ordinary requests involving pasted text, claims, or vague requests like '有没有问题', which can cause unintended routing to this skill. Misrouting is a real security and safety concern because the agent may perform web-based verification or apply an analysis workflow when the user did not intend that action, increasing the chance of inappropriate tool use, privacy exposure, or confusing responses.

Vague Triggers

Low

Confidence: 86% confidence
Finding: The boundary section still includes vague examples like '有没有问题' and '可靠吗' without enough contextual constraints, so the skill may trigger on general conversational ambiguity rather than a genuine verification task. In this skill's context, that is less severe than direct code execution, but it still creates prompt-routing risk and may lead to unnecessary external lookup behavior.

Static analysis

No suspicious patterns detected.