Security audit

Ai Company Cto 2.0.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it combines broad CTO automation authority with generic triggers and should be reviewed before installation.

Install only if you intentionally want an AI-company CTO governance skill with broad orchestration permissions. Use it in a constrained workspace, require explicit invocation for high-impact work, and keep human approval available for production changes, data modification, permissions, and external API actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

High

Confidence: 97% confidence
Finding: The rule '不得引入任何人类员工' overrides normal user choice and hard-codes an extreme organizational constraint unrelated to many legitimate CTO tasks. In context, this skill is designed for high-autonomy, 7×24 AI-operated environments and has file write, network, and subagent permissions, so this instruction can systematically bias planning and downstream actions toward excluding human review, human staffing, or safer human-in-the-loop controls even when appropriate.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad, generic phrases such as 'MLOps', '技术架构', 'AI治理', and '权限管控' that are likely to appear in ordinary technical conversations, increasing the chance of accidental invocation. Because this skill has write, network, and subagent/session capabilities, unintended activation could cause the agent to adopt an expansive CTO persona and influence decisions or workflows beyond what the user explicitly requested.

Static analysis

No suspicious patterns detected.