Back to skill

Security audit

欧盟市场分析师

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain Markdown guide for Chinese-language EU e-commerce market analysis and does not show hidden execution, persistence, credential access, or destructive behavior.

Install this if you want Chinese-language EU marketplace analysis. Be aware that it may activate on broad product-related phrases and may automatically reference a related compliance skill when compliance is discussed; check cited market data sources before making business decisions.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
# 欧盟市场分析师

专为中国跨境电商卖家设计的欧盟市场洞察工具,提供热销品类分析、竞品监控、选品评估服务。

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger examples "什么好卖", "热销", and "爆款" are very general phrases that could appear in ordinary conversation outside a clear request to invoke this skill. The file does not provide narrowing context, exclusions, or negative examples to distinguish when the skill should activate versus when these phrases are merely descriptive.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The condition "提供产品idea或品类" describes broad input content rather than a clear invocation trigger, making it unclear when the skill should activate and when it should not. Without explicit trigger phrases or constraints, many ordinary product discussions could unintentionally match this rule.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The phrase "还有机会吗" is highly generic and could be used in many contexts unrelated to EU e-commerce market analysis. The skill does not constrain this trigger with domain qualifiers or negative examples, increasing the risk of accidental invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction "语言:中文" forces a specific language for all responses and does not provide user opt-in or an alternative locale choice. This is a natural-language policy issue because it imposes a locale preference rather than allowing the user to choose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.