Back to skill

Security audit

intimate-ch11-conflict

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese study aid for one textbook chapter and does not request system access, run code, or persist anything.

Install this if you want Chinese tutoring support for this specific Intimate Relationships chapter. It should not be treated as therapy, crisis support, legal advice, or a safety plan, and users who prefer another language may need to ask explicitly because the materials are written in Chinese.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L29 states '中文回答' because the user is currently using Chinese, which imposes a language policy on the skill's behavior. Under the policy rule, forcing a specific language without explicit user opt-in or offering a choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file consists entirely of Chinese instructional content and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file is entirely written in Chinese and provides usage guidance such as '优先使用本文件中的教材原例' without offering any language choice or stating that the skill is intentionally limited to Chinese users. Under the policy, a skill that effectively constrains output or operation to a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This reference file is entirely written in Chinese and presents the skill content in a single fixed language. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all instructional content in Chinese and does not indicate that the user can choose another language. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

该 markdown 文件的自然语言内容完全以中文呈现,未见任何提示说明这是特定受众或区域限定材料,也未给出语言/locale 选择。根据语言/locale 政策,若技能内容默认强制单一语言且无用户选择或明确合理说明,可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all instructional content in Chinese and does not mention any user language preference, opt-in, or region-specific justification. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.