Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
文件名和全文内容表明该技能固定为中文（zh-CN）版本，但文档中未说明这是用户可选语言，也未提供语言切换或适用范围说明。根据语言/地区政策，强制特定语言而无用户选择或明确的地区性理由，属于自然语言策略风险。
- Content
Security audit
Word Mail Merge Template Workflow
Security checks for vulnerabilities and agentic risk
Overview
This is a Word/DOCX mail-merge workflow helper with no executable code, no credential handling, and no persistence; its main risk is broad implicit invocation that users may want to narrow.
Safe to install for Word mail merge and DOCX template help. Consider narrowing or disabling implicit invocation if you want the skill to activate only when explicitly requested for Word/DOCX workflows.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger sentence is so broad and malformed that it can match ordinary user language rather than a deliberate invocation of this skill. That increases the chance of accidental routing or over-activation, which can cause the agent to apply the wrong workflow or expose irrelevant capabilities in normal conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger sentence begins with highly common phrasing ('Help me') and then appends a broad capability description, making accidental activation much more likely. In an agent environment, overly generic triggers can cause the wrong skill to be invoked for unrelated user requests, leading to misrouting, unintended prompt/context injection, or execution of workflow guidance outside the intended scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This trigger is also overly broad because 'I need a practical workflow for...' is a common conversational pattern and lacks strong activation boundaries. Because the skill concerns document automation used in legal, HR, and administrative contexts, accidental invocation could expose sensitive workflow handling to the wrong skill path or interfere with correct tool/skill selection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation section lists generic English phrases such as "Help me" and "I need a practical workflow" wrapped around a long description, but it does not clearly define when the skill should or should not activate. These phrases overlap with common user speech and there are no negative examples or explicit scope constraints to prevent unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description uses very broad activation terms tied to common productivity topics, which can cause the skill to be invoked outside narrowly intended Word mail-merge scenarios. Over-broad routing is dangerous because it can unexpectedly steer unrelated user requests into this skill, producing irrelevant guidance, bypassing better-matched skills, or expanding the attack surface for prompt-injection-style misuse through accidental invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example trigger phrases begin with very common conversational language such as 'Help me' and 'I need', making the trigger boundary unclear and increasing the chance of unintended activation from ordinary user text. This is risky because benign conversations may match the examples heuristically, causing misrouting and reducing user control over when the skill is applied.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill enables allow_implicit_invocation without any visible trigger constraints, exclusions, or scope limits, which can cause the agent to invoke this skill in situations the user did not explicitly request. That increases the attack surface for prompt-routing mistakes, accidental data exposure to the skill context, and unintended workflow execution, even though the skill’s stated purpose is legitimate productivity automation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance is ambiguous and includes malformed examples, making skill selection unpredictable. In an agent system, unclear trigger scope can lead to inappropriate activation, reduced user control, and interference with other skills that should handle more general productivity requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This file is written as a Chinese user-facing README, but it does not state that the user may choose another language or that the locale restriction is intentional for a region-specific audience. Under the language/locale policy, user-facing material should not implicitly force a language without opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.