Security audit

ranbing

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only clarification and translation skill with broad activation language but no code, install actions, persistence, or hidden data access.

Install this if you want Chinese-language help turning vague requests into clearer prompts or delegation templates. Expect it to intervene on broad or ambiguous phrasing and to use a playful Chinese style unless you explicitly ask for a different tone or language.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill description says it should be used whenever a user gives a vague instruction, which is a very common conversational pattern. That broad trigger can cause the skill to activate in many ordinary interactions, potentially intercepting requests unexpectedly and reshaping user intent before the user explicitly asked for clarification or translation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The file explicitly states that the skill automatically activates when user instructions are vague or incomplete, but does not define measurable boundaries for 'vague' or 'incomplete.' In an agent ecosystem, ambiguous auto-activation can lead to unintended control flow, unnecessary delegation, or alteration of normal assistant behavior across many benign prompts.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The translation mode specifies English-to-Chinese output with 'lobster annotations' and does not offer a user language preference. This is not a classic security flaw, but in practice it can create policy and usability risks by transforming content into an unintended language, potentially causing miscommunication, mishandling of multilingual workflows, or accidental disclosure to the wrong audience.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: 该 markdown 文件适用 SQP-1。L013 列出的“帮我”“我想”“要不要”“怎么做”都是高频日常表达，缺少领域限定、上下文约束或排除条件，容易在普通交流中错误触发此模板。

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: 全文模板与固定话术均以中文呈现，文件标题和内容未说明这是仅面向中文用户的区域性技能，也未提供其他语言选项。根据 SQP-3，若技能强制特定语言而没有用户选择或明确合理性说明，应视为自然语言策略问题。

Static analysis

No suspicious patterns detected.