Deep Discussion

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

This is a legitimate multi-agent discussion skill, with the main caveat that it saves complete discussion transcripts in workspace files.

Install this only for discussions where saving a full transcript is acceptable. Do not use it with secrets, credentials, regulated personal data, or confidential material unless you are comfortable with that content being written into workspace files and included in reports. Expect long-running subagent activity and review the generated workspace/deep-discussion output afterward.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Ssd 3

High

• Confidence: 99% confidence
• Finding: The task template explicitly combines user background with instructions to preserve complete raw expert outputs, creating a strong pathway for sensitive user-supplied context to be propagated into persistent artifacts. Because multiple experts may restate, elaborate, or quote that background, the skill amplifies both duplication and exposure of private information.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The explicit bans on summarizing, omitting, or delaying writes force full disclosure and retention of whatever content experts produce, including sensitive or policy-restricted material. In a multi-agent setting, this is particularly dangerous because raw outputs can include transformed user secrets, internal reasoning fragments, or unnecessary personal and confidential details that should have been minimized before storage.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### Issue 3: Lost Session Keys

**Symptom**: Cannot send messages to experts

**Cause**: Did not track session keys

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are exclusively Chinese, and much of the operational guidance and sample interaction is written as if the skill is intended to run in Chinese by default. There is no explicit opt-in, language selection, or documented reason that the skill must be Chinese-only, which creates a locale policy concern.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill writes several persistent files into the workspace but does not clearly warn the user that filesystem state will be modified and retained. This can surprise users, cause unintended persistence of sensitive content, and increase exposure if the workspace is later inspected or synced elsewhere.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Mandating storage of complete raw expert outputs without warning or minimization creates a privacy and data-handling risk. If the discussion includes sensitive user context, secrets, or regulated data, the skill instructs the system to persist that content verbatim into an artifact that may later be accessed, shared, or retained longer than necessary.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Aggregating all raw expert outputs into a single transcript increases data concentration and retention risk. Consolidating potentially sensitive content into one file makes accidental disclosure, over-sharing, or later misuse more likely, especially when the skill is designed to gather broad contextual input across multiple agents.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: L48 says no other files should be created after discussion completion beyond the listed outputs, to avoid duplication. Later sections introduce `workspace/deep-discussion/{topic-slug}/orchestrator-state.json` as a required persisted state file (L702-L709), which conflicts with the earlier instruction that no additional files be created.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The repeated requirement to immediately append every expert's complete raw output institutionalizes indiscriminate transcript retention. This removes any opportunity for contextual filtering before persistence and increases the chance that sensitive prompts, user data, or confidential analysis are written to disk verbatim.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: At L422-L434 the file explicitly states that the Orchestrator 'must' use `mode: "session"` and explains why `run` is unsuitable for coordination. Immediately afterward, the sample launch code at L441-L447 sets `mode: "run"`, which directly contradicts the stated requirement rather than merely omitting detail.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file includes orchestrator prompts and focus labels in Chinese within an otherwise English document, which effectively imposes a specific language on part of the skill behavior. The file does not provide user opt-in, language alternatives, or a justification that the skill is region-specific, so it conflicts with the language/locale policy requirement.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The protocol repeatedly prescribes Chinese-language file names, prompts, templates, and example interactions throughout the document, such as the agenda templates and orchestrator prompts. Because the document does not offer a language choice or explain a justified region-specific constraint, it creates a natural-language locale policy violation under the language/locale rule.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown template is entirely written in Chinese, including headings, field labels, and boilerplate text, which implies the skill will generate discussion records in a fixed language. The file does not offer a language option or explain a justified region-specific constraint, so it conflicts with the policy against forcing a specific language without user opt-in.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The manifest says each agenda item goes through 3 rounds: Diverge → Discuss → Converge. This template instead defines 5 rounds (问题定义, 创意生成, 批判分析, 方案综合, 行动计划) and even hard-codes '总轮次 | 5' in the statistics section, which directly conflicts with the documented skill behavior.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file presents all role definitions and usage instructions solely in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The report template hard-codes several Chinese column headers and role labels such as '发言次数', '总字数', '平均响应时间', and 'AI/ML 专家'. This imposes a specific language/locale in user-facing output without any opt-in or explanation, which matches the language policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Core operational instructions are presented in Chinese and use mandatory language such as '必须' and '禁止', but the file does not indicate that the user can choose another language or that the locale restriction is intentional and justified. This can violate language or locale policy when a skill effectively forces a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly requires appending each expert's complete output to discussion-log.md, with no minimization, redaction, or sensitivity checks. In a multi-agent setting, expert outputs can contain user-provided secrets, proprietary data, or other sensitive intermediate reasoning, so verbatim persistence materially increases disclosure risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Mandating that the orchestrator append complete raw expert outputs creates a straightforward natural-language data leakage path. Because the orchestrator coordinates multiple experts over complex problem discussions, those outputs may include copied context, confidential inputs, or sensitive generated content that becomes permanently exposed in shared artifacts or reports.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The prescribed markdown format stores each expert's complete original output verbatim, which amplifies the chance that sensitive content is replicated and later disclosed through files, summaries, or downstream processing. Verbatim archival is especially risky in an agent skill because experts may echo hidden prompts, user data, credentials, or proprietary analysis into a durable log.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The template hard-codes core instructions, required output formats, and the startup command in Chinese, including phrases like '必须启用', '创建议程清单', and Chinese-only file content requirements. There is no user opt-in, language selection, or documented regional justification, so this constitutes a locale/language policy issue.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The template explicitly requires appending each expert's complete raw output into a persistent `discussion-log.md`, which can capture secrets, personal data, internal reasoning, or unsafe/generated content without minimization or redaction. In a multi-agent setting, this increases the blast radius because multiple subagents may echo sensitive inputs, and the instruction normalizes durable storage of all such content in a workspace file.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown template mixes English and Chinese, but key report headings, tables, and status labels are prescribed in Chinese such as '深度讨论报告' and '议程完成情况'. Because the file provides no user opt-in or explanation that the skill is intended only for a Chinese-language context, it creates a natural-language locale policy concern.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly instructs appending discussion content to a file immediately, but it does not require user consent, disclosure, or any data-sensitivity check before persisting potentially private prompts and model outputs. In a multi-agent discussion skill, those outputs may contain proprietary, personal, or regulated information, so silent disk writes create avoidable data retention and privacy risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow directs the agent to synthesize and save a final report without any warning that the report will become persistent output. Because the report may aggregate all prior expert discussion, it can concentrate sensitive information into a durable artifact, increasing exposure if logs or files are later accessed by others.

Static analysis

No suspicious patterns detected.