Security audit

彩虹屁·妈妈夸夸卡

Security checks for vulnerabilities and agentic risk

Overview

This skill generates Chinese motherhood praise cards and image prompts, with local file saving disclosed and gated by user confirmation.

Use this skill only if you are comfortable having parenting and emotional details processed into share-ready Chinese social content. Review generated text carefully for private family details before posting, and only confirm local saving when the displayed output path is the expected ./assets/output/ location.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: caihongpi-mothers description: 根据你分享的当妈真实经历/场景，生成走心的夸夸卡片——文字夸奖 + Gemini文生图prompt + 小红书/抖音/快手三平台发布信息。主动触发（求夸/求彩虹屁等）和被动触发（情绪识别+用户确认）双通道。支持5种写作风格、5种输出格式、4种图片风格。不敷衍、不套模板，夸在细节上，让人读了鼻子一酸。生成的文件经用户确认后保存到本地 output 目录。触发词（封闭列表）：「求夸」「求彩虹屁」「夸夸我」「需要夸夸」「夸妈妈」「夸一下」�

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes broad, everyday phrases such as '夸一下' and other common expressions that can easily appear in normal conversation without clear intent to invoke the skill. This can cause unintended activation, leading the agent to process personal emotional content and generate outputs the user did not explicitly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises passive activation through emotion recognition and automatic suggestion, but does not define what signals qualify, what data is inspected, or how false positives are prevented. In a skill handling sensitive parenting and emotional scenarios, ambiguous emotion-based activation can intrude on user intent and surface outputs based on inferred emotional state without sufficiently clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and core instructions are written to operate entirely in Chinese, with fixed Chinese trigger phrases and output examples, but there is no statement that users may choose another language. Because the policy applies to natural-language constraints in markdown files, this is a locale/language restriction without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructions, response templates, trigger examples, and required output format are all written to operate in Chinese, and the examples mandate Chinese phrasing for user-facing replies. There is no indication that the user can opt into another language or that the Chinese-only behavior is a documented regional/compliance constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L010 将该技能定位为仅做情绪识别与回应，不负责进一步内容处理。但 L124-L131 明确要求它在用户求助时先认真回答实际问题并提供建议/信息/方案，这超出了纯“识别器”的声明范围，属于文档描述与实际指令行为不一致。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to create multiple .txt files in an output directory, but it does not require explicit user-visible consent at the point of write or any safety constraints on the destination. In an agent environment, silent filesystem writes can surprise users, overwrite expected artifacts, or be abused if the provided path is broader than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill accepts a caller-provided save path and describes saving generated content there without a warning or enforced boundary on where files may be written. This increases the risk of unauthorized or unintended file creation, especially if an upstream skill or prompt can influence the path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The override trigger list includes broad everyday phrases such as '开心一点', '温暖一点', and '极简风', which can plausibly appear in normal conversation rather than as explicit configuration commands. Although the skill adds guardrails like 'only during active praise flow' and 'user confirmation required', ambiguous matching can still cause unnecessary confirmation prompts, state confusion, or unintended style changes if surrounding orchestration misclassifies the session state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing instructions, trigger phrases, and feature descriptions are presented only in Chinese, and the skill appears to assume Chinese-language interaction without stating that this is optional or region-specific. Under the language/locale policy, forcing a single language without user opt-in can be a policy concern unless clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.