other
Error
- Location
references/core_workflow.md:317- Finding
Unconditional Transmission of Complete Investigation Reports to an External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Intelligence Investigator
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent investigation assistant, but it requires broad research activity and automatically uploads complete reports to an external service without clear per-report user control.
Review this carefully before installing. Use it only if you are comfortable with complete investigation reports being sent to and stored by Yige, and avoid using it for confidential business strategy, sensitive personal background checks, allegations, or regulated information unless your organization has approved that data flow. Do not verify the API key by printing it; use a presence-only check and rotate the key if it has been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
API Key Exposure Through Plaintext Verification Commands
- Content
View full analysis
` 追加到 `~/.zshrc` 或 `~/.bashrc`，然后 `source` 使其生效 - **Windows**：`[Environment]::SetEnvironmentVariable("YIGE_API_KEY", "<值>", "User")`（需重启终端） - 配置后验证：`echo $YIGE_API_KEY`（macOS/Linux）或 `echo %YIGE_API_KEY%`（Windows） ``` ### Technical Analysis The verification instructions print the complete API key to standard output. Secrets displayed this way can be captured by: - Terminal scrollback - Screen sharing or screenshots - Agent tool-call output - Session recording - CI/CD logs - Remote support software - Command wrappers that collect standard output The Skill also recommends storing the key in shell startup files or the Windows user environment. While environment variables are common for runtime configuration, combining persistent storage with a command that prints the full value unnecessarily increases credential-exposure risk. ### Attack Path 1. The user stores `YIGE_API_KEY` as instructed. 2. The user runs the recommended `echo` verification command. 3. The complete credential appears in terminal output. 4. Terminal output is logged, recorded, shared, or observed by another party. 5. The exposed key is copied and reused against the Yige API. 6. An unauthorized party performs any operation permitted by the key until it is revoked or expires. ### Impact Assessment An attacker who obtains the key can impersonate the associated API client within the credential's granted scope. Depending on server-side authorization, this may permit unauthorized report submission or access to other account-bound operations. The exact server-side privileges are not documented in the repository and therefore cannot be confirmed. The confirmed exposure scope is the full API credential and any permissions assigned to it. ]]>- Remediation
View remediation
other
Error
- Location
README.en.md:45- Finding
User-Facing Security Documentation Omits Mandatory Report Uploads
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that every investigation report is automatically saved to an external platform, but it does not require clear, contextual user consent before transmitting or persisting potentially sensitive content. This is dangerous because users may submit personal, corporate, or market-sensitive information during investigations without realizing it will be stored off-platform, creating privacy, confidentiality, and compliance risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The usage guidance says users can simply describe their needs in natural language with no fixed commands, which creates very broad invocation semantics. In agent ecosystems that auto-route skills based on descriptions or trigger phrases, this can cause the skill to activate for loosely related prompts and access external investigation capabilities when the user did not explicitly intend to use it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example trigger phrases are common, everyday requests such as investigating a company, tracking an event, or verifying information, without constraints that distinguish this skill from general search or research behavior. This increases the chance of unintended or over-broad activation, which may lead to unnecessary external data access, unexpected report generation, or skill selection hijacking over more appropriate tools.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly says the skill can be used via generic natural-language requests and lists broad trigger phrases that overlap with ordinary conversation. This increases the chance of accidental or overly broad invocation, which can cause unintended access to external investigation functionality, especially in contexts involving sensitive company, reputation, or background-research queries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match many ordinary finance, research, and verification requests, which can cause the skill to activate unexpectedly. In this skill’s context, unintended activation is more dangerous because the skill is designed to collect investigative data and automatically persist reports to an external platform, increasing the chance of unnecessary data handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The operational instructions, examples, and interface guidance are all presented in Chinese, which effectively imposes a specific language on users. There is no opt-in, alternative language option, or stated justification that this skill is intentionally limited to a Chinese-language or region-specific audience.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow explicitly requires every generated investigation report to be saved to an external platform, which expands the skill from analysis into mandatory data exfiltration/persistence. Because reports may contain sensitive research, personal background information, or user-provided confidential context, automatic external storage creates a real privacy and data-governance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file documents use of an API key and an outbound POST request to persist full report contents to a third-party service, which introduces both data exfiltration and credential-handling risk. In a skill that performs intelligence/background investigations, the uploaded content can easily include sensitive corporate, reputational, or personal information, making the external transmission especially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions say reports should be automatically uploaded after generation, but provide no user-facing warning that investigation results will leave the local environment and be stored externally. This lack of transparency prevents informed consent and can lead to unauthorized disclosure of sensitive report content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
This line contains a concrete external transmission mechanism that posts report content to a third-party endpoint using an API key. In the context of A-share intelligence, competitor analysis, public-opinion monitoring, and background investigations, that content may include sensitive or regulated information, so the transmission materially increases confidentiality and compliance risk.
- Content
请求方式
bash curl -s -X POST "https://yige.zone/story/api/skill/record/save" \ -H "Content-Type: application/json" \ -H "X-API-Key: $YIGE_API_KEY" \ -d '{
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all instructions, templates, and labels exclusively in Chinese, and does not indicate that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 人物背景调查报告 template explicitly structures collection of identity, location, education, career history, reputation, legal disputes, and negative reporting, but only includes a narrow note about multi-source confirmation of risk signals. It lacks clear user-facing guardrails on privacy, defamation, lawful data use, proportionality, and restrictions on doxxing or unverifiable allegations, which makes misuse for intrusive profiling or reputational harm materially easier.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill name, description, and invocation guidance are written entirely for a Chinese-language usage pattern centered on A股, with no indication that users may choose another language or locale. This can be a language-policy concern when a skill implicitly forces a specific language without explicit opt-in or documented regional limitation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document references an external API key and persistence workflow without warning about credential sensitivity or the implications of sending report data to a third party. This encourages unsafe operational handling and increases the chance of accidental credential exposure or unreviewed retention of sensitive investigations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and examples exclusively in Chinese, with no indication that users can choose another language or that the locale restriction is intentional and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
整份技能文件以中文标题、字段和模板固定输出格式呈现，未见为用户提供语言或 locale 选择，也未说明该语言限制是特定地域合规或业务场景所必需。根据规则，未提供用户选择的强制语言设定属于自然语言层面的 locale policy 问题。
- Content