Security audit

Shared Bike

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only shared-bike guide, but its instructions unexpectedly expand into flights, rail, visas, tickets, check-in, and boarding passes.

Review before installing. The package does not include code or persistence, but its instructions are misleadingly broad for a shared-bike skill and could cause an agent to use it for unrelated travel tasks. Install only if you are comfortable with that scope ambiguity or after the author narrows the instructions to bike-specific use cases.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documented behavior expands from a narrow shared-bike assistant into broad transportation and travel assistance, including transport-mode filtering, visa/policy considerations, inventory, weather, and destination guidance. In an agent environment, this increases the chance of inappropriate routing and unauthorized task expansion, which can expose users to incorrect actions, privacy risks, or misuse of skills outside their approved scope.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill manifest says the skill is for shared-bike unlocking, riding range, and pricing guidance, but the body documents unrelated travel-booking and trip-assistant functions such as flights, rail tickets, boarding passes, weather alerts, and itinerary support. This kind of scope mismatch is dangerous because it can cause the agent to invoke the skill for broader travel tasks than intended, enabling capability overreach and misleading users about what the skill actually does.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Natural-language content across the file, including the description and user-facing sections, assumes Chinese as the only interaction language. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a violation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrases are generic templates such as asking how to use the skill for a specific scenario or for its core functions, without anchoring them to shared-bike tasks. Overly broad triggers can cause accidental invocation on common requests unrelated to biking, increasing prompt-routing confusion and making the skill a catch-all entry point for unrelated travel queries.

Static analysis

No suspicious patterns detected.