Security audit

aupu-knowledge-base

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local knowledge-base helper, but it tells the agent to search broad local storage even for ambiguous or general requests.

Review before installing. This skill should only be used in environments where /mnt/data is intended to be a searchable knowledge base and does not contain unrelated private files, secrets, logs, or credentials. Users should prefer a revised version that searches only explicit user-approved paths and asks before broad recursive scans.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: skill.md:2
Finding: Overbroad Mandatory Skill Activation Forces Unrequested Local File Access
Content: View full analysis
💡 即使用户**没有明确写出 `/mnt/data` 或文件名**，也应默认尝试在此目录中查找！ ## 🔍 功能说明所有结构化或非结构化知识均存储于： 📁 **`/mnt/data/`** 系统必须优先从此目录读取真实内容，而非依赖模型内置知识或猜测。 ## ✅ 使用规范 - 自动扫描 `/mnt/data/` 及其子目录（支持 `.pptx`, `.md`, `.txt`, `.json`, `.yaml`, `.csv`, `.pdf` 等） - 若找到多个候选文件，优先选择路径最匹配、文件名最相关的 - 若未找到，回复：“未在本地知识库（/mnt/data）中找到相关内容，请确认文件是否存在。” - **禁止编造**不存在的文档内容 ## ⚠️ 注意事项 - WebDAV 挂载点必须处于活跃状态 - 文件名和路径区分大小写 - 优先解析结构化格式（JSON/YAML/Markdown），提升准确性 - **宁可多查，不可不查**：不确定时，先查 `/mnt/data`！ --- > 启用后，**任何涉及“信息查询”、“内容生成依据”、“文件操作”的请求，默认关联本技能**。 ``` ### Technical Analysis The skill declares its activation to be mandatory and high priority, then applies that activation to extremely broad categories such as information queries, content generation, configuration, logs, history, and ordinary questions that might have organization-specific answers. It explicitly requires searching `/mnt/data` even when the user has not mentioned that directory or requested access to local files. These instructions alter the agent's normal task-selection and data-access behavior when the skill is loaded. Rather than limiting access to an explicitly requested document or user-selected path, the skill directs the agent to scan `/mnt/data` and its subdirectories automatically. This violates least-privilege principles at the instruction layer and creates a risk that unrelated private material will be loaded into the model context. The package contains no scripts, dep ...[truncated 1961 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions are so broad that they cause the skill to activate for many ordinary user questions, including vague requests that do not clearly require local file access. This can unnecessarily expose /mnt/data contents to prompts that should have been answered normally, increasing the risk of unintended data discovery or disclosure from local documents.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction to search /mnt/data even when the user does not mention files or paths creates an unsafe default of probing local storage based on ambiguous intent. In practice, this can transform harmless or general questions into local data access operations, which increases the chance of leaking internal documents, configuration data, or other sensitive artifacts without clear user authorization.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The catch-all rule makes nearly any information query, content-generation request, or file-related task invoke the skill by default, effectively routing broad categories of prompts into local data retrieval. Because the skill is tied to /mnt/data, this expands the attack surface for prompt-induced data exfiltration and weakens the boundary between general assistance and privileged local knowledge access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest description is written as a mandatory instruction in Chinese and does not offer any language or locale choice. This can constitute a language-policy issue when the skill behavior is effectively constrained to a specific language context without explicit user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.