Security audit

DevTrace - 技术决策五算子

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese technical-decision checklist with broad activation wording, but it does not request tools, persistence, credentials, code execution, or data access.

Install this if you want a structured Chinese framework for technical and architecture decisions. Expect it to impose a topology, entropy, dependency, and recommendation format when it thinks a technical decision is being discussed; users who prefer another language or less rigid formatting may need to explicitly override it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill is written to operate in Chinese and mandates a fixed output structure without offering user language choice. In a multilingual agent, this can cause instruction misalignment, reduced transparency, and failure to respect user preferences, which is especially problematic when discussing high-stakes technical decisions where clarity matters.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill auto-activates on very broad phrases like 'how to do', 'which to choose', 'risk', or 'can it go live', which overlap with ordinary technical conversation. This can cause the skill to engage unexpectedly, override more specific user intent, and force a rigid decision framework even when the user did not request it, increasing the chance of prompt-scope capture and degraded agent behavior.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The manifest description only states the skill name and that it is a 'complete version' of a technical decision method, but gives no specific trigger phrases, activation conditions, or scope boundaries. In a manifest file, this lack of specificity can lead to ambiguous matching and unintended invocation because users and systems cannot tell when the skill should or should not apply.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The natural-language description is written entirely in Chinese, which may imply a fixed language/locale requirement, but the manifest provides no indication that this is optional or intended for a specific region. Without user opt-in or documented locale scope, this can violate language-choice policy expectations.

Static analysis

No suspicious patterns detected.