T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:73- Finding
Overbroad Access to Private User and Agent Data Without Prior Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
智能体成长复盘
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent report-writing purpose, but it asks the agent to read and combine broad personal and agent history before the user approves the scope.
Install only if you are comfortable with the skill reviewing stored memories, profile/config files, Skill records, conversation summaries, task results, and knowledge-base materials to produce one consolidated growth report. Before running it, explicitly tell the agent which sources, date range, and projects are allowed, and do not approve Memory write-back or file export until you have reviewed the draft.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description explicitly states it will automatically read memory, identity, skills, conversation records, task results, and knowledge materials, but it does not require a clear privacy notice or user-visible consent first. This creates a real privacy risk because highly aggregated personal and behavioral data may be accessed and synthesized into a report without sufficiently explicit authorization at the moment of use.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow directs the agent to read memory, SOUL, USER, agent config, skill lists, knowledge base, and recent conversation summaries before asking for confirmation, then present a consolidated summary back to the user. This sequencing is dangerous because it normalizes broad access first and notice second, undermining informed consent and increasing the chance that sensitive information is surfaced or over-collected unnecessarily.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is designed to consolidate broad categories of personal data and conversation history into a natural-language growth report. That creates a genuine data exposure path: aggregation increases sensitivity, makes private patterns easier to infer, and can reveal more than any single underlying source would on its own.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list includes broad natural-language phrases related to growth reflection, which can cause the skill to activate in situations where the user did not intend a deep retrospective. In this skill, accidental activation is more sensitive because activation leads to reading memory, profiles, skills, and conversation history, increasing the chance of over-collection and disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Generalized phrases like summarizing recent changes with AI create ambiguous activation boundaries. Because this skill is designed to aggregate personal records and histories, an overly broad trigger increases the risk that sensitive retrospective analysis is started from casual conversation rather than deliberate user consent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default instruction to read memory, user profile, agent config, skill history, knowledge base, and recent conversations before engaging the user encourages broad collection by default. In context, this is more dangerous because the skill's purpose is retrospective synthesis, so the collected data is likely to be personal, longitudinal, and easy to disclose back in one place.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatically reading multiple platform files and conversation summaries and then presenting a compiled list back to the user creates an aggregation-and-disclosure pattern. Even if shown to the same user, this can surface forgotten, sensitive, or contextually inappropriate details and increases the blast radius of any mistaken access or prompt-triggered invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
L255 指定“中文字体：正文宋体、标题黑体”，结合全文中文固定模板与 L432 的固定“我/您”对话要求，体现出输出被默认锁定为中文书信体。文件未说明这是面向特定中文地区用户的限定，也未提供用户选择其他语言/locale 的机制，存在语言/locale 策略风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L431-L438 明确要求报告采用中文书信体并固定用“我”“您”贯穿全文，属于对输出语言和表达风格的硬性规定。由于文档没有提供多语言选项、自动跟随用户语言的说明，或中文限定的业务理由，这构成自然语言层面的 locale 强制。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Earlier sections require the report to include a human-AI collaboration comparison table and explicitly permit tables in the letter-style format (L305-L315, L389-L390, L411-L412). Line L437 then states the whole report should not use lists, numbering, tables, or bullet points, which directly conflicts with those mandatory format requirements.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The default prompt and described invocation phrases are broad enough to overlap with normal reflective requests such as summarizing recent progress or changes. This can cause the skill to activate unexpectedly and access or synthesize sensitive memory, identity, conversation, and task-history data in situations where the user may not have intended this more invasive review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger resolution rules include broad everyday phrases such as “我最近怎么样”, and prioritize automatic routing based on loosely defined keywords. In a skill that can read memory, identities, skills, dialogue records, task results, and knowledge materials, an accidental invocation can expose or process sensitive personal context without the user clearly intending a growth-review workflow.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Most of the document repeatedly requires the report body to stay within 1500-2500 words/characters of text length (for example L233, L271, L425, L438), but L489 says the report should be 2000-5000 words. This is not just incomplete guidance; it gives incompatible constraints for what the skill should generate.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
全文以中文固定描述技能职责、触发词和路由规则，但未见任何允许用户选择语言或说明该技能仅限特定语言/区域场景的声明。按照 SQP-3，若技能对语言/locale 有隐含强制约束而未提供 opt-in，可能构成自然语言策略问题。
- Content