Security audit

石油工程油藏论文写作专家团

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WorkBuddy deployer for a petroleum-reservoir academic writing team, with expected local plugin changes and team-agent handling of user-provided research material.

Before installing, review that it will add a persistent WorkBuddy expert team under your WorkBuddy configuration and update marketplace.json. When using it, avoid giving confidential drafts, unpublished data, personal notes, or cloud-note content unless you are comfortable with those materials being processed by the team agents.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to run a deployment script that reads environment variables and writes files into the user's WorkBuddy plugin directory, but it does not declare any explicit tool scope or permissions. This creates a trust and transparency gap: an agent or user may trigger filesystem-modifying behavior without a clear permission boundary, increasing the risk of unauthorized local changes or abuse if the skill contents are altered.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The deployment instructions explicitly direct copying files into the user's local WorkBuddy plugin directory and modifying marketplace.json, but they do not clearly warn the user that local files and configuration will be changed. In a skill ecosystem, silent or under-disclosed persistence into plugin directories is security-relevant because it can establish lasting agent behavior and make later execution of installed content easier without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The agent is explicitly instructed to send the complete formatting plan and submission checklist back via SendMessage, but there is no constraint to minimize data, redact manuscript content, or obtain user confirmation before transmitting potentially sensitive unpublished research details. In an academic-paper workflow, formatting plans, figure/table notes, author metadata, and submission-package details can include confidential manuscript content or personally identifiable information, creating an unnecessary data-exposure path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L44 states that Chinese papers default to a specific mixed Chinese/English formatting convention, and the overall instructions are written as a Chinese-only role specification. This imposes a locale/language expectation without explicitly offering the user a choice or opt-in, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill body is written as direct instructions in Chinese and does not state that the user may choose another language. This creates a natural-language locale policy issue because the skill appears to enforce a specific language without opt-in or an explicit, justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The agent is instructed to collect and structure notes from multiple personal and local sources, then mandatorily send the compiled knowledge base back via SendMessage. Because those notes may contain unpublished research, proprietary data, personal annotations, or other sensitive content, forcing transmission without explicit user consent, minimization, or a warning creates a real data-exfiltration/privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates sending the complete fact-checking report back via SendMessage, but gives no indication that potentially sensitive manuscript content, unpublished research data, citations, or experimental details may be transmitted to another party. In a research-paper workflow, this creates a real data-handling and privacy risk because users may provide confidential drafts or proprietary reservoir data without understanding that the agent is instructed to forward the full report externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction to always send the complete topic plan back via SendMessage creates an implicit data exfiltration path to another agent or controller without any disclosure, consent step, or data-minimization rule. Because the plan may include the user's unpublished research ideas, datasets, project constraints, or target journals, this can leak sensitive intellectual property beyond the immediate conversation scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest uses a Chinese-only display name and description, presenting the skill as operating in a specific language without offering any language choice or documenting that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy requirements when no explicit opt-in or justified regional constraint is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents the skill’s purpose, features, and usage examples exclusively in Chinese. Because the file does not offer users a language/locale choice or explain that the skill is intentionally limited to Chinese-speaking users, it creates a natural-language locale policy concern under the rule’s language-choice requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Natural-language policy checks apply to all file types, including markdown. The operational instructions and output requirements are presented only in Chinese, which can amount to forcing a specific language without user opt-in or an explicit documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The operational instructions and output requirements are entirely specified in Chinese, and there is no statement that the user may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language instructions are entirely in Chinese and direct the agent's behavior in that language, without indicating that the user may choose another language. This can violate language/locale policy when no user opt-in or documented justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions and output requirements are all specified in Chinese, which can force a specific language experience without user opt-in. There is no indication that the agent can switch languages based on user preference despite bilingual metadata earlier in the file.
Content: No source excerpt is available for this finding.