Security audit

餐饮供应链成本分析

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed restaurant supply-chain cost analysis helper with no executable code, persistence, credential use, or hidden data movement.

Install only if you want Chinese-language restaurant supply-chain cost analysis. Use it with procurement or supplier datasets, and be aware that generic phrases like cost analysis may trigger this specialized reporting workflow.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill metadata embeds broad trigger phrases in the description, which can cause the skill to activate for ordinary business conversations that merely mention cost analysis or supplier comparison. Mis-triggering is dangerous because it can override user intent, produce irrelevant structured outputs, or steer workflows using rigid domain rules without the user explicitly requesting this specialized analysis.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger rules are context-free and lack exclusion criteria, so common phrases like '成本分析' or '供应链分析' may activate the skill even when the user is asking for something else. In this skill, that is more risky because it enforces domain-specific assumptions such as full-category scope and cold-chain logistics rules, which could lead to incorrect analyses or misleading recommendations when applied out of context.

Static analysis

No suspicious patterns detected.