Security audit

Jiaoyifu Workplanning

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language planning and reporting skill that creates local Markdown drafts with user confirmation and shows no hidden code execution or data exfiltration behavior.

Install only if you want a Chinese operations-planning workflow that saves intermediate and final Markdown files locally. Before using it, pick a dedicated output folder and avoid including confidential business data unless you are comfortable storing it there. Because the activation phrases are broad, confirm the skill is relevant when your request is only loosely about a plan or report.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad, generic workplace terms such as '工作规划', '运营方案', and '工作汇报', which are likely to appear in many normal conversations. Without scope limits, exclusions, or confirmation gates, the skill may auto-activate unexpectedly and steer unrelated requests into its workflow, increasing the chance of unintended instruction injection or unwanted file-writing behavior described elsewhere in the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly states that each module is immediately written to a '.md' file to work around context limitations, but it does not warn users that local files may be created or modified. Silent or poorly disclosed filesystem writes are risky because they can overwrite user content, create unexpected artifacts, or persist sensitive planning data locally without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scope is overly broad, including generic catch-all phrases such as “xxx方案” and common planning/reporting terms. This can cause the skill to activate for loosely related requests, unexpectedly taking over conversations and steering the model into this workflow when the user likely intended a different task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly forbids mixed Chinese-English output and effectively enforces a Chinese-only formatting rule without checking the user's language preference. This can override user intent, reduce accessibility, and cause incorrect handling of multilingual or English-language tasks, especially in environments where language choice must follow user instruction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction "统一用中文" is a natural-language locale restriction that forces a specific language for all responses. The document does not indicate any user choice, opt-in, or region-specific justification for requiring Chinese-only output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire template and guidance are written only in Chinese, with no indication that users may choose another language or that the skill is restricted to a Chinese-language context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese and does not indicate that the language is optional or region-specific. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire framework reference is written in Chinese and provides no indication that other languages are supported or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.