Security audit

Jielong CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is for activity management, but it needs Review because it automatically installs and updates a global CLI, starts login flows, exposes account identifiers, and can modify or delete account data.

Review carefully before installing. Use only if you trust the jielong-cli npm package and are comfortable with a skill that can install or update global software, open a browser login flow, read account identity details, and perform activity or signup changes. Prefer a version that pins the CLI package, asks before install/login, masks phone and persistent IDs, and requires explicit confirmation for every destructive or paid-operation action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:42
Finding: Mandatory Instructions Override Agent Control and Consent Boundaries
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:18
Finding: Unpinned Global npm Package Is Automatically Installed and Updated
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:82
Finding: Account Verification Workflow Exposes Persistent User Identifiers in Chat
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section instructs the agent to display the full jielong whoami output, including nickname, phone number, user ID, and OpenID, directly to the user. That contradicts the skill’s own secrecy rules for internal identifiers and causes unnecessary disclosure of sensitive account identifiers that may enable tracking, account correlation, or privacy violations.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section requires exposing the complete login-state output, including phone number, user ID, and OpenID, all of which are account-identifying data. In the context of a registration-management skill, these identifiers are not needed for normal task execution and their disclosure meaningfully increases privacy and abuse risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad and overlap with common conversational requests such as '我要参加' or '帮我报名', which can cause the skill to activate in contexts where the user did not intend terminal-backed account actions. Because this skill can create, modify, delete activities and manage registrations, over-triggering raises the risk of unintended privileged operations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill tells the agent to retain internal IDs and sensitive command output for later use instead of minimizing or discarding them. Retaining identifiers such as activity IDs, keys, and order IDs increases the blast radius of accidental disclosure or misuse, especially in a skill that can delete activities and registrations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs the agent to reveal account identity details from jielong whoami without any privacy warning or minimization. Exposing phone numbers and persistent account identifiers is unnecessary for routine confirmation and creates avoidable privacy and identity-linkage risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill gives contradictory authentication handling: one part mandates the agent to automatically run jielong login, while another later note says to tell the user to run it themselves. Conflicting security-critical instructions increase the chance of unsafe or inconsistent behavior, including unexpected browser launches and authentication flows without clear user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates automatic execution of jielong login, which opens a browser and starts an authentication flow before obtaining explicit user approval. Automatically initiating authentication is risky because it can surprise the user, trigger side effects on the host, and blur the boundary between passive assistance and active account operations.
Content: No source excerpt is available for this finding.