Security audit

New App

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed documentation-first workflow for bootstrapping internal apps, with no executable payload or hidden privileged behavior.

Install this if you want a structured workflow for creating new internal apps. Before using it, confirm that its bilingual documentation expectation and Next.js/FastAPI/Keycloak/PostgreSQL-oriented assumptions fit your team; otherwise treat those parts as local process guidance to adapt.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill’s activation description is broad enough to match many generic planning, architecture, or product-bootstrap requests, increasing the chance it is invoked outside its intended scope. Over-broad activation can steer the agent into applying heavyweight workflow instructions unnecessarily, causing inappropriate task capture, reduced user control, and possible propagation of unrelated repo conventions or process assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is entirely written in Chinese and is named with a .cn.md locale suffix, which indicates a fixed language requirement. There is no accompanying statement offering language choice or explaining that this checklist is intentionally region- or audience-specific, so it may violate the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Line L039 states that English and Chinese documentation must stay aligned, which imposes a specific language requirement by default. The file does not indicate this is optional, user-selected, or justified as a region-specific requirement, so it fits the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The checklist explicitly requires both English and Chinese documentation updates as a fixed requirement. This imposes a language policy without indicating that the language choice is optional, user-selected, or justified by a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown template appears to require Chinese as the working language for all users, and there is no accompanying note that the language is optional, selectable, or limited to a specific region or audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.