Security audit

USA Business Migration Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a harmless documentation workflow, but its name and activation metadata do not match its actual CDN-selection content.

Review before installing. This skill does not show code execution or data-theft behavior, but its label is misleading and its triggers are broad, so it may activate for the wrong requests unless renamed and scoped to CDN/vendor-selection tasks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README claims this skill is a 'USA Business Migration Planner' but nearly all requirement, evidence, and trigger text is actually about choosing a global CDN alternative to Cloudflare. This semantic mismatch can cause the wrong skill to be invoked or trusted under false pretenses, which is dangerous in agent systems because routing, user consent, and downstream actions may occur based on deceptive or inaccurate metadata.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill’s declared identity is a USA business migration planner, but the actual content is about CDN vendor selection and Cloudflare timeout constraints. This mismatch can cause the wrong skill to be invoked in unrelated contexts, bypass user expectations, and route sensitive or irrelevant requests into an unintended workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation description is ambiguous because it mixes generic assistance language with a very specific CDN-related requirement, without defining clear boundaries for when the skill should activate. This can lead to unintentional invocation and misapplication of the skill in contexts far outside its intended domain.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords include very broad terms such as 'general-help', which can match many unrelated user requests and cause accidental activation. Over-broad activation increases the risk of prompt-routing errors, irrelevant instruction injection into conversations, and unintended handling of user tasks by the wrong skill.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation description says to use the skill for broad categories like general-help, v2ex, cdn, and mbps, without clearly defining boundaries. Ambiguous activation criteria make it easier for the skill to be selected in unintended contexts, which can mis-handle user requests and create a prompt-routing weakness in multi-skill systems.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keywords include very broad terms like 'general-help' and common topic words, which can cause accidental activation during ordinary conversation. In an agent environment, overbroad triggers expand the skill's execution surface, allowing irrelevant or adversarial prompts to invoke it and potentially override more appropriate skills or workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata and the documented behavior are materially inconsistent: the name implies USA business migration planning, while the file implements CDN vendor-selection guidance. This can cause the wrong skill to be invoked, confuse routing and review controls, and lead users or downstream agents to apply unrelated instructions in an unintended context. The mismatch is especially concerning because broad trigger terms may cause activation outside the expected domain.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence uses a very broad everyday phrase ('Help me ...'), which creates a substantial risk of accidental or overly frequent invocation. In an agent environment, such generic triggers can hijack normal conversations, causing the skill to activate when the user did not explicitly request CDN-selection help and potentially override better-matched skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger examples use generic phrases like 'Help me' and 'I need a practical workflow,' which are common in normal conversation and can cause unintended skill activation. In an agent environment, over-broad activation expands the attack surface by allowing this misdocumented skill to intercept unrelated requests, potentially producing irrelevant, misleading, or unsafe actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary help-seeking language, which can cause the skill to activate outside its intended scope. In a routing or tool-selection system, this creates prompt-surface expansion and increases the chance that irrelevant or low-quality instructions are injected into unrelated conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description embeds a Chinese-language requirement and assumes that locale/context without confirming user preference or explaining why that market context is necessary. This can cause mismatched outputs, inappropriate recommendations, or routing based on language/locale assumptions rather than the user’s actual need.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger phrases use common language like 'Help me' and 'I need a practical workflow', which is too generic and may train or bias invocation toward ordinary requests. Even if the remainder of the phrase is more specific, these patterns widen activation surface and make accidental routing more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is labeled as a USA business migration planner, but its actual behavior and examples are about CDN vendor selection. This semantic mismatch can cause the wrong skill to activate or be trusted under false pretenses, leading to user confusion, misrouting of requests, and unsafe execution of irrelevant instructions. The suspicious mismatch increases risk because deceptive naming is a known way to smuggle unintended behavior into agent toolchains.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill content contains substantial Chinese and English mixed together, but does not state that the user can choose their preferred language or locale. This can amount to a language-policy issue because the skill implicitly imposes presentation choices without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt is phrased as a general request template and includes broad language like "help me," which can match ordinary user speech rather than a narrowly scoped invocation. In combination with a reusable workflow-oriented description, this increases the chance of accidental or undesired activation, causing the skill to handle requests outside a clearly intended boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Enabling implicit invocation without strict trigger constraints allows the skill to be invoked from loosely related user requests. Because the skill description spans broad categories like general-help and implementation support, this can cause over-triggering, context hijacking, or unintended routing of user conversations into this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The requirement text embeds Chinese-language content inside an otherwise English document, but the file does not state whether the skill should respond in Chinese, English, or based on user preference. This can violate language/locale policy expectations because the skill appears to impose or assume a language without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance is ambiguous and insufficiently constrained, making it unclear when this skill should activate and increasing the chance of misrouting. Because the surrounding skill identity is already inconsistent, ambiguous trigger rules further amplify the risk of unintended execution in unrelated user contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The README lists separate English and Chinese instruction files, while the requirement and examples mix languages, but it does not explicitly state that the user can choose their preferred language. This creates a mild natural-language policy concern because locale handling is not clearly framed as user-directed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This Chinese README contains substantial English instructional text and trigger phrases, but does not state whether users may interact in Chinese, English, or choose their preferred language. That can create an implicit language policy constraint without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The default prompt contains both English and Chinese text, but there is no indication that the user is being offered a language choice or that multilingual behavior is intentional. This can create an implicit language/locale policy issue if the skill responds in a language the user did not explicitly select.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.