Security audit

technical-research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed technical research workflow that searches the web and writes structured Markdown reports, with no evidence of hidden, destructive, credential-seeking, or privilege-expanding behavior.

Before installing, expect the skill to perform live web research and create several Markdown files in a research/{topic}/ directory. Use it in a workspace where generated research files are acceptable, and check for existing files with the same topic name if overwrites would matter.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly states that invoking the skill will create multiple files under research/{topic}/, but it does not warn the user that the skill performs filesystem writes or describe where those writes occur relative to the workspace. In an agent setting, undocumented file creation can cause unintended persistence, overwrite existing content, or leak sensitive research topics into the local repository/workspace without informed user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description activates on very broad phrases like “调研 / 研究 / 了解某技术领域”, which commonly appear in ordinary conversation and can cause unintended invocation. This is dangerous because it may route unrelated user requests into a workflow that performs extensive web queries and file-generation behavior the user did not explicitly request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs creation of a directory tree and multiple Markdown output files in the workspace, but provides no requirement to warn the user or obtain consent before modifying files. This is risky because accidental activation could lead to unexpected workspace changes, overwrite existing research artifacts, or clutter repositories with generated content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language invocation examples are limited to Chinese phrasing, which can be read as prescribing a specific language for use. Because the file does not mention language flexibility or user choice, this may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document mandates a source-language mix of approximately 70% English and 30% Chinese. This is a locale/language preference encoded as policy without indicating user choice or explaining that the user can request a different language balance.
Content: No source excerpt is available for this finding.