Security audit

Mio智能聊天

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language chat helper that stores limited local habit data, with privacy and trigger-scope caveats but no evidence of exfiltration, destructive behavior, hidden persistence, or privilege escalation.

Install only if you want a Chinese-language chat companion that learns limited local habit signals. Review or clear artifact/data/habits.json if you do not want chat-time and topic-pattern history retained, and consider narrowing triggers or disabling proactive/habit-learning settings if unexpected activation would bother you.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger phrases are very broad everyday terms such as '聊天', '任务', and '想聊', which are likely to match normal user conversation unintentionally. In a skill described as proactive chat plus task distribution with habit learning enabled, this can cause unexpected activation, over-collection of conversational context, and unintended delegation of actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that it records active times, topic preferences, and chat patterns, but it does not warn users that behavioral data is being stored. Collecting and persisting this profiling data without clear disclosure increases privacy risk and can enable unwanted tracking or secondary use of personal behavior information.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables proactive conversation initiation based on a vaguely defined 'idle' or habit-based condition without documenting clear boundaries, consent, or safeguards. Ambiguous autonomous activation can lead to unwanted contact, privacy intrusion, and behavior that exceeds user expectations, especially because the system explicitly learns user habits to decide when to engage.

Natural-Language Policy Violations

Medium

Confidence: 71% confidence
Finding: The skill description is presented entirely in Chinese and describes user-facing chat behavior, but there is no indication that language selection is optional or user-configurable. This can imply a fixed language/locale experience without user opt-in, which may violate language-choice policy expectations.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The top-level comment describes this as a '主动聊天 + 任务分发系统' that learns habits, proactively chats, and performs intelligent task distribution. In practice, dispatchTask only labels the task type and returns a response object, with no downstream routing, tool invocation, or execution logic, so the documentation overstates what the skill actually does.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: All user-facing natural-language strings and the skill description are in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only region or audience. This can violate language/locale policy when a skill imposes a language without opt-in.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill persistently stores behavioral metadata such as chat timestamps, active hours, and topic interests to local disk without any consent flow, disclosure, retention policy, or access controls. This creates a privacy risk because the data can reveal user routines and interests, and if the host is shared or compromised, that history can be exposed or misused.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The natural-language instructions and feature descriptions are entirely in Chinese, and the file does not indicate that this language choice is optional or restricted to a justified locale-specific deployment. This may violate a language or locale policy requiring user choice or explicit documentation of locale constraints.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill advertises proactive chatting but does not clearly warn that it may send unsolicited messages based on inferred idle periods. This can surprise users, create trust and safety concerns, and become intrusive when combined with habit learning and autonomous triggering.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: The comment frames detectFreeState as '空闲状态检测', implying it determines current user availability. However, the code merely inspects previously recorded hourly activity counts from habits.json and infers availability from coarse historical patterns, which is not true current-state detection.

Static analysis

No suspicious patterns detected.