Ai Company Cho 2.0.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 2.0.1

Overview

This HR governance skill is coherent in purpose but requests broad file, network, session-messaging, and delegation powers without enough scoping for sensitive personnel workflows.

Review this skill before installing in environments with real employee, performance, compensation, compliance, or agent-governance data. It should be limited to approved HR files, approved API destinations, and named agent/session recipients, with explicit confirmation before writes, external transmission, personnel-impacting decisions, or subagent delegation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:48

Finding

Overly Broad Permissions Violate Least-Privilege Principles

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-51
Vulnerability Type: Excessive file, network, session-messaging, and delegation permissions
Risk Level: Medium

Vulnerable Configuration

yaml

permissions:
  files: [read, write]
  network: [api]
  commands: []
  mcp: [sessions_send, subagents]

Technical Analysis

The skill declares unrestricted file read/write access, network API access, cross-session messaging through sessions_send, and subagent delegation. Its documented purpose is strategic HR analysis and the production of policy, compliance, and governance assessments. The configuration does not specify required file paths, permitted write targets, approved API destinations, data-handling restrictions, or delegation boundaries.

This violates the principle of least privilege because the declared capabilities exceed the minimum privileges demonstrated by the documented advisory workflows. Although no malicious executable code or explicit exfiltration instruction was found, these permissions create exploitable access paths if malicious or untrusted task content influences the skill.

Attack Path

1. An attacker supplies a crafted HR task or strategic-context value containing instructions to inspect unrelated local information.
2. The skill uses its broad files: [read, write] permission to read sensitive files or alter files outside a narrowly defined HR workspace.
3. The skill uses network: [api] or sessions_send to transmit retrieved information or send attacker-controlled instructions to another session.
4. The skill invokes subagents to delegate additional operations, increasing the scope of the original request.
5. Because no path, endpoint, recipient, or delegation allowlist is defined, the resulting activity may extend beyond the legitimate HR-governance task.

This is a capability-based exploitation path. The reviewed files do not establish that the skill c ...[truncated 702 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove file access, network access, session messaging, and subagent delegation by default.
2. If file access is necessary, replace unrestricted access with explicit read-only path allowlists.
3. Grant write access only to designated output or audit directories, using atomic writes and preventing path traversal.
4. Restrict network access to documented HTTPS endpoints, approved methods, and required request fields.
5. Require explicit user approval before transmitting employee, performance, compliance, or other potentially sensitive information.
6. Disable sessions_send unless a documented workflow requires it; otherwise, restrict recipients and message schemas.
7. Disable subagents unless delegation is essential. If enabled, enforce depth limits, capability restrictions, and non-inheritance of unnecessary privileges.
8. Add runtime authorization checks and audit logging for every file write, outbound request, cross-session message, and subagent invocation.
9. Apply data minimization and redact sensitive HR information before any authorized transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list contains broad generic role terms such as 人事官 and 人力资源官 that can match ordinary HR-related prompts, increasing the chance this high-privilege skill is invoked unintentionally. Because the skill has write, network, and MCP capabilities plus L4 governance scope, accidental activation could expose sensitive HR workflows or cause unintended downstream actions through other agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requests file write access, network API access, and MCP session/subagent capabilities, but the user-facing description does not clearly disclose operational impact or sensitive-data handling expectations. In an HR governance skill, this omission is riskier because users may provide personnel, performance, or compliance data without understanding that the skill can write data, call external services, or orchestrate other agents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.