Security audit

Workflow Decomposer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed workflow-planning helper with optional local progress tracking, and I found no hidden exfiltration, destructive behavior, or unsafe persistence.

Install this if you want an agent to break complex tasks into visible steps and track progress. Be aware that it may encourage use of specific model families, may produce Chinese-language output, and may create local workflow-state.json files for progress tracking.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 描述覆盖了四类核心能力，但代码仅覆盖其中一部分：进度和状态跟踪。虽然状态结构中包含 decomposer_model 与 step 的 model_used 字段，说明其支持记录模型信息，但并没有任何逻辑去分析任务、生成步骤、选择模型或诊断阻塞问题。主功能因此明显比声明更窄，属于描述与实际行为不一致。不过代码的文件读写仅用于保存工作流状态，这与“跟踪进度”这一已声明用途一致，不构成额外未声明能力。

Natural-Language Policy Violations

Medium

Confidence: 76% confidence
Finding: The entire README is presented in Chinese and labels itself as the usage instructions, with no indication that users may choose another language or that the locale is region-specific. This can constitute a language/locale policy violation when the skill appears to prescribe a specific language without opt-in.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README states that the skill will 'automatically trigger' whenever a complex work task is received, but it does not define clear boundaries, scope limits, or user confirmation requirements. In an agent setting, overly broad trigger conditions can cause the skill to activate on unintended requests, leading to unnecessary task decomposition, unexpected model orchestration, and possible leakage of task context to additional tools or models.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The manifest description and the full instructional content are written in Chinese and present the skill behavior as operating in that language by default. There is no statement offering multilingual operation, user language preference, or justification for a China-specific locale constraint.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown reference is written entirely in Chinese and does not indicate that language selection is optional or region-specific. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in or documented justification.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown file includes a model-specific prompt pattern entirely in Chinese for the Qwen series, even though the surrounding guide is in English and states only that Qwen handles Chinese and English equally well. Because it presents the Chinese template as the default pattern without opt-in or an alternative, it effectively forces a locale choice in a way that can violate language/locale policy.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: This markdown file presents all workflow instructions and templates in Chinese, which effectively imposes a specific language on users. The policy allows fixed-language behavior only when users are given a choice or when the locale constraint is clearly documented and justified, neither of which appears here.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code file contains multiple CLI messages in Chinese, including status output and command feedback, which forces a specific language for all users. Under the policy criteria, hard-coded locale/language behavior without user opt-in or clear justification is a natural-language policy violation.

Static analysis

No suspicious patterns detected.