Security audit

Jielong CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent jielong activity-management wrapper, but it should be reviewed because it automatically changes the host environment, initiates login, exposes account identifiers, and can modify or delete signup data.

Install only if you trust the jielong CLI package and are comfortable with a skill that can globally install/update software, open a login QR flow, reuse a logged-in jielong account, and perform activity or signup mutations including deletion. Treat account identity output as sensitive and confirm destructive operations outside the CLI prompt as well.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill requires automatically running a global npm install/upgrade before handling any user request, which expands its behavior from activity management into modifying the host environment. This creates supply-chain and integrity risk because a routine user request can trigger package installation, version changes, or execution of package lifecycle scripts without necessity or explicit user consent.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The login instructions are internally contradictory: some text says the AI must execute login itself and not ask the user to use the terminal, while other parts imply user-driven follow-up and manual confirmation. In practice, contradictory auth flows increase the chance the agent mishandles credentials, loops on login attempts, or performs authentication actions without clear consent boundaries.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill claims internal identifiers must never be exposed, but elsewhere instructs the agent to display raw whoami output containing identifiers such as UserID and OpenID. This contradiction can lead to disclosure of internal account identifiers that may be sensitive, linkable across systems, or useful for targeted abuse and account enumeration.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad enough to match ordinary conversational requests like 'help me sign up' or 'look at my activity,' which can cause this skill to activate in contexts the user did not intend. Over-broad activation is dangerous here because the skill can perform state-changing operations such as login, deletion, signup management, and environment modification.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to expose account identity details from CLI output directly to the user without a privacy warning or minimization. Showing nickname, phone number, and related account metadata can leak personal information to the wrong viewer in shared-session, delegated, or misrouted conversations.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly requires exposing raw login/account details from the CLI to the user, including personally identifying and internal account information. In an agent setting this is particularly risky because the agent may reveal another person's logged-in account context, creating privacy, impersonation, and account-confusion risk.

Static analysis

No suspicious patterns detected.