Security audit

sandbox simulator

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language roleplay simulation skill that creates and updates local Markdown scenario files, with no evidence of hidden code execution, exfiltration, or destructive behavior.

Install this only if you want a Chinese-language simulation workflow that stores scenario state in local Markdown files. Use a dedicated workspace or scenario folder, prefer explicit /sandbox commands for mutations, and review any future external API extensions before enabling them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill states the scheduler cannot perform file I/O and must delegate all such work, but later workflow steps instruct it to update and read state files as part of normal operation. This contradiction creates unsafe ambiguity about which agent is authorized to mutate persistent state, increasing the chance that an implementation bypasses intended tool restrictions or mishandles delegated writes.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The 'absolute prohibition' section forbids direct file I/O by the scheduler, yet the rest of the skill repeatedly requires reading world state, updating character files, and saving history. This inconsistency can lead operators or downstream agents to ignore safety boundaries, producing unauthorized persistence, corrupted state, or ad hoc tool use to satisfy conflicting instructions.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The entire skill description, commands, examples, and operating instructions are presented only in Chinese, effectively imposing a language constraint on users. The file does not offer a language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description advertises Markdown-backed state and interactive control but does not warn that using the skill creates and modifies persistent files. That omission can mislead users about side effects, causing unintentional overwrites, data retention, or execution in sensitive workspaces.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The natural-language examples map broad phrases like '暂停', '继续', and event-like statements directly to state-changing commands without clear activation boundaries or confirmation requirements. In mixed conversation, this can trigger unintended sandbox actions, including persistent state mutation or simulation control changes, from ordinary dialogue.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The manifest describes a local sandbox simulation system using sessions_spawn and Markdown-backed state management for multi-character social dialogue. L566 introduces integrating external APIs or data sources via spawn tasks, which expands the skill into networked/external-system access not required by the stated simulation purpose.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: This markdown template is entirely written in Chinese, including headings, labels, and inline instructions, which imposes a specific language on users. The file does not indicate that language selection is optional or configurable, so it can violate a language/locale policy requiring user choice.

Vague Triggers

Low

Confidence: 86% confidence
Finding: The trigger section says initialization can be activated by natural language '创建一个场景', which is a generic phrase that could appear in normal discussion. No narrowing context, required prefix, or negative examples are provided to distinguish invocation from casual conversation.

Vague Triggers

Low

Confidence: 85% confidence
Finding: The trigger section allows natural language '开始推演' to start execution, but this phrase is broad and the document does not define contextual limits for activation. Without explicit boundaries, ordinary planning or discussion could be misinterpreted as a command.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: This markdown file presents all user-facing character information and dialogue style instructions in Chinese, which can effectively force a specific language/locale on downstream use. The file does not offer any user opt-in, alternative language option, or explicit justification that the skill is intended only for a Chinese-language context.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: This markdown file presents all headings and behavioral content in Chinese, which can amount to a language/locale policy issue if users are not given an opt-in or alternative language. The file does not indicate that the character definition is intentionally region-specific or that Chinese is a documented requirement.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The character description and all interaction-style fields are written entirely in Chinese, which can impose a specific language/locale on downstream use without any indication that users may choose another language. The file does not document that this is a China-specific or Chinese-only scenario, so the locale restriction appears implicit rather than justified.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The character profile headings and content are entirely written in Chinese, which creates an implicit language constraint for anyone consuming or using this skill. There is no indication that the user can choose another language or that the file is intentionally limited to a Chinese-language or region-specific scenario.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: This markdown file presents the character skill content exclusively in Chinese, and it does not mention any user-selectable language or locale option. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This markdown file uses only Chinese for headings and narrative content, which can amount to a language/locale restriction if the skill is expected to be generally usable. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The file’s natural-language content is entirely in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill implicitly enforces one language without opt-in or justification.

Static analysis

No suspicious patterns detected.