Security audit

Deep Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed reading-analysis skill that processes user-provided books, documents, or URLs and does not show hidden execution, persistence, credential use, or destructive behavior.

Install this if you want an agent to analyze books, long documents, or web articles. Only provide files and URLs you are comfortable having processed, and be aware that its broad trigger examples may make it activate for generic summary or comparison requests unless your agent requires explicit skill invocation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented trigger phrases are broad, common-language expressions such as 'main idea', 'overview', and 'compare', which can cause the skill to activate when the user did not intend to invoke a book-reading workflow. In an agent environment, unintended invocation can route unrelated user content or file paths into this skill, leading to incorrect handling of inputs, privacy exposure of attached documents, or disruption of other skills' expected behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad, common-language phrases such as “主要内容”, “详细分析”, and “对比分析”, which can match many ordinary user requests outside the intended deep-reading context. In an agentic environment, this can cause unintended skill activation on unrelated inputs, leading to misrouting, over-broad file/URL handling, or unexpected access to attached book/document content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L003 及全文说明均以中文固定描述技能行为，且未说明可根据用户偏好切换语言或允许其他语言输出。按照语言/区域政策，若技能默认或强制特定语言而未提供用户选择，属于自然语言层面的策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The webpage trigger phrases are broad, natural-language expressions such as '分析这个网页' and '这篇文章讲了什么', without requiring strong context that the user explicitly wants this specific skill. In an agent environment with multiple skills, this can cause unintended invocation on ordinary browsing or summarization requests, increasing the chance of fetching and processing attacker-controlled URLs or irrelevant external content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The analytical-reading trigger list includes vague phrases like '详细分析', '深入分析', and '核心论点' that commonly appear in many unrelated user requests. Because these phrases lack domain constraints tying them to books or long-form articles, the skill may activate outside its intended scope and perform unnecessary content loading or analysis, including on untrusted inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The entire skill-improvement document is written in Chinese and all example prompts and response guidance assume Chinese-only interaction, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file discusses trigger matching using common phrases such as “主要内容”, “详细分析”, and “这本书对我有什么用”, but it does not define boundaries, negative examples, or context constraints. Because these are ordinary conversational phrases, they could overlap with everyday requests and lead to unintended skill invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The skill structure states that README.md is Chinese documentation while README_EN.md is "This file," yet the reviewed README.md content is in English. This inconsistency suggests a fixed language expectation in the documentation structure without clearly offering user language choice or documenting locale behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language audience. Under the language/locale policy check, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file is entirely written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language violations, fixed language output without opt-in can be a locale-policy issue when no justification or user choice is stated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.