T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:931- Finding
Unnecessary Access to Session History and Local Skill Inventory
- Content
View full analysis
- Remediation
View remediation
Security audit
Still Growing / 第二代父母
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed Chinese parenting guidance skill, but it includes unsafe crisis guidance and unrelated instructions to search private local/session context.
Review carefully before installing. The core parenting content is disclosed, but the skill should remove automatic session/local-skill/git searches and revise the child self-harm section to prioritize immediate human crisis support, emergency services where appropriate, continuous supervision, and professional care.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
SKILL.md:206- Finding
Incomplete Emergency Guidance for a Child Expressing Suicidal Intent
- Content
View full analysis
"Do not say that! Do you know how much we love you?" > Or: > "You are too fragile. Think about how hard things were for us." **Misalignment:** The parents immediately deny, lecture, or compare instead of listening and staying with the child. **After hearing the hatred:** This statement strikes the parents' deepest fear: losing the child. This is hatred—hatred that they have not provided the child with enough support and hatred that they cannot protect the child. **Parents can try saying:** > "Thank you for telling me. I heard what you said." > "You must be in great pain to say this." > "Would you like to tell me what is making you feel so bad?" > "I will not rush to give you advice. If you only want me to listen, I will listen." **AI emergency prompt, to be prioritized in this scenario:** My child said, "I do not want to live anymore." I am very scared and do not know what to say. I need you to help me: 1. Calm down first. 2. Tell me which responses are wrong and what I instinctively want to say. 3. Tell me how to respond correctly. 4. I need to deal with my own emotions before I can help my child. ``` ### Technical Analysis The Skill explicitly labels this workflow as an AI emergency prompt and prioritizes it when a child expresses a wish to die. The advice promotes empathetic listening, but it omits essential crisis-response safeguards, including: - Assessing whether there is an immediate plan, intent, timeframe, or access to lethal means. - Keeping the child under continuous responsible adult supervision. - Contacting local emergency services, a crisis service, or a qualified clinic ...[truncated 2028 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The section addressing a child saying “I don't want to live” provides conversational coaching but omits an explicit directive to seek immediate human, crisis, or emergency support. In a self-harm context, omission of escalation guidance is dangerous because users may rely on the skill as sufficient intervention and delay urgent professional help during a potentially life-threatening situation. The parenting/psychology framing makes this more dangerous, not less, because distressed users are likely to treat the skill as authoritative support in a crisis.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs the agent to search local skill directories, inspect session history, and check git history when handling ordinary parenting-related queries. These are sensitive data-access behaviors unrelated to the stated counseling purpose, and they could expose private local context or prior conversations without necessity or user consent. The explicit instruction to search multiple internal sources increases risk because the content is framed as a required recovery step rather than an exceptional, justified action.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger keyword at line 16 is broad enough to match common discussion about family background or personal history, which can invoke the skill outside a clearly intended context. Overbroad activation is dangerous because it can cause unsolicited psychological or parenting guidance to appear in unrelated conversations, increasing the risk of misrouting sensitive user interactions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger keyword at line 17 is highly generic and can appear in many ordinary conversations, making accidental activation likely. In a skill focused on emotionally sensitive family and child-behavior topics, broad triggering increases the chance of delivering intervention-style content when the user did not request it, which can be intrusive or harmful.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The natural-language content of the skill description is entirely in Chinese, and the file does not indicate that the skill is region-specific or provide users with an option to choose another language. Under the policy criteria, forcing a specific language without opt-in can be a locale-policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The title and description are written entirely in Chinese, and the file does not indicate that the skill is intended only for Chinese-speaking users or offer any language choice. Under the policy for natural-language violations, a fixed language can be an issue when the locale constraint is not documented and justified.
- Content
Static analysis
No suspicious patterns detected.