CEO决策助手

• Outcome: Review
• Latest audit: May 28, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This appears to be a real CEO assistant configuration, not malware, but it deserves review because it combines permanent executive memory, scheduled autonomous jobs, and broad Feishu access without enough privacy and scope controls.

Install only after confirming you are comfortable with scheduled Feishu reports and permanent memory over sensitive CEO conversations. Use a least-privilege Feishu app, keep App Secret out of chats and repositories, restrict recipients and document/wiki/drive scopes, review or disable the daily knowledge-base update, and make sure stored memories can be inspected and deleted.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The routing rule uses a single lexical trigger—whether the user included the exact term “主脑”—to decide if the main agent acts directly or delegates. This is brittle and can be manipulated or accidentally triggered by unrelated text, causing tasks to be executed by the wrong actor and bypassing intended safety boundaries around tool use and execution roles.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase "安装技能" is a common, natural-language request that could easily appear in ordinary conversation, causing the skill to activate or initiate installation-related behavior unexpectedly. In a skill that can manage other skills, broad activation increases the risk of unintended system changes or social-engineering-driven actions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The phrase "精简技能" is similarly broad and may match casual requests about simplifying or organizing skills rather than an intentional administrative command. Because it appears to control removal or modification of installed capabilities, accidental activation could disable functionality or alter the environment without clear user intent.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: Routing behavior based merely on the presence of the word "主脑" is overly permissive and can be triggered by benign mentions, quoted text, documentation, or prompt injection embedded in user content. Since the rule changes whether the system executes directly or delegates to sub-agents, an attacker could manipulate control flow and bypass intended user-approval boundaries.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The README advertises automatic Feishu pushes, persistent memory, and automatic knowledge-base updates without clearly warning users about data disclosure, retention, and autonomous system modification. In a business-decision assistant for CEOs, these features can expose sensitive corporate information or change internal knowledge stores without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly documents persistent storage of core memory, daily logs, user preferences, taboos, and instruction patterns, but provides no retention limits, consent flow, access controls, or privacy notice. For a CEO-focused assistant, this can accumulate highly sensitive strategic, personal, and operational data, increasing the risk of unauthorized disclosure, over-collection, and noncompliant handling of personal or corporate information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to configure Feishu app credentials and advertises real-time notifications, but does not warn that data may be transmitted to an external messaging platform or define what content is sent. In a CEO decision-support context, notifications may include sensitive business intelligence, project status, or financial signals, creating leakage risk through third-party systems, misconfiguration, or overbroad message content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The scheduled job explicitly says it will extract new preferences, taboos, and instruction patterns from daily conversations and update a knowledge base automatically. This creates ongoing retention of potentially sensitive behavioral and personal data without any visible consent, disclosure, minimization, or review controls, increasing privacy and secondary-use risk.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The skill directs persistent storage of broad user information such as preferences, lessons, and ongoing context without data minimization or sensitivity limits. In a CEO assistant context, that can easily capture confidential business strategy, personal data, or sensitive operational details and retain them longer than necessary, increasing privacy and data exposure risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The self-optimization and scheduled knowledge-base update sections instruct the system to broadly capture corrections, preferences, repeated instructions, and “instruction patterns” into persistent memory and internalized lessons. This creates a strong risk of storing sensitive or adversarial content permanently, and can also poison future behavior by turning transient user prompts or malicious instructions into long-lived system guidance.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Automating extraction of conversation-derived preferences and instructions into a persistent knowledge base can capture secrets, sensitive personal preferences, operational directives, or confidential business details that appeared in chats. Because this happens on a schedule and without evident safeguards, the skill context makes the issue more dangerous by turning incidental conversation content into durable stored data that may later be surfaced or leaked.

Static analysis

No suspicious patterns detected.