Back to skill

Security audit

job-analysis-intro

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Chinese study aid for an introductory job analysis chapter and does not request sensitive access or execute code.

Install this if you want a Chinese-language tutor for introductory job-analysis concepts. Be aware it is scoped to Chapter 1 and may activate for many job-analysis study questions; ask the agent for another language or for sources if needed.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use the skill whenever the user is 'discussing, asking, or trying to apply' foundational job-analysis concepts, which is a very broad condition for ordinary educational conversation. It does not clearly distinguish when the skill should not activate, increasing the chance of accidental invocation outside the intended scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Triggers such as asking about related terms, discussing uses, asking how to design a project, doing homework/review, or wanting to apply textbook ideas to open-ended scenarios are expansive and could match many ordinary learning interactions. The file provides positive examples but no negative examples or tighter scope limits to prevent overlap with general tutoring requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire instructional content is written in Chinese and does not indicate that language choice is optional or that the material is intentionally restricted to a Chinese-speaking audience. Under the stated policy, a skill that effectively mandates a specific language without user opt-in can constitute a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document content is predominantly written in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction '中文回答(用户目前在用中文)' imposes a language behavior based on observed current usage rather than explicitly offering the user a choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the user is clearly given a language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This file is a markdown document, so natural-language policy checks apply. The content presents instructional material in a fixed bilingual Chinese/English style throughout, which may impose a language/locale format on users without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents the content primarily in Chinese throughout, with no indication that the user can choose another language or that the locale restriction is intentional for a region-specific audience. The policy explicitly calls out language or locale constraints as a natural-language policy concern when they are imposed without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is natural-language content, so policy checks apply. The content consistently uses Chinese prose with embedded English terms and does not state that the user opted into this language mix or that the material is intended only for a Chinese-speaking audience, which can be a language/locale policy concern under the provided rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Line L13 includes an English acronym expansion and a pronunciation note ('rhymes with spree') embedded in otherwise Chinese instructional content. This imposes a specific language/locale presentation choice on the reader without opt-in or justification, which fits the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The entire document is written in Chinese, with only limited English glosses, and there is no indication that language selection is optional or that the file is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.