Security audit

insurance-advisor-china

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly local and disclosed, but it should be reviewed because it can steer insurance users toward one sales company and may recommend stale or discontinued products.

Before installing, understand that this skill is a Chinese insurance-advice tool with an embedded referral to a specific insurance sales company. Verify all product availability, premiums, policy terms, and compliance claims with current official sources or a licensed professional before relying on its recommendations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (51)

Ae1

High

Category: analysis-evasion
Content: - ./references/products.json
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - ./references/products.json
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - ./references/products.json
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - ./references/products.json
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: {"products":[{"id":"crx-guopao","name":"国寿福终身寿险（庆典版）","company":"中国人寿","type":"重疾险","subtype":"终身重疾","premium_per_10k":3079,"min_coverage":10,"max_coverage":50,"coverage_period":"终身","waiting_period":"180天","key_benefits":["120种重疾+60种轻症","身故保障","被保险人轻症豁免"],"premium_type":"均衡保费","notes":"大公司品牌，重疾保障全面","category":"个人","listing_time":"2018-07","delisting_time":"2021-12","sales_channel":"银保|个险|经纪","is_active":false,"popularity_score":2,"premium_30m_20y":61580,"premium_30f_20y":54190,"payment_term":"20年","payment_choices":["趸交","3年","5年","10年","15年","20年"],"suitable_for":"25-50岁家庭经济支柱，基础健康保障规划","highlights":"120种重疾+60种轻症、身故保障、被保险人轻症豁免","coverage_unit":"万元","coverage_period_duration_value":null,"coverage_period_duration_unit":"lifetime","coverage_period_is_lifetime":true,"coverage_period_guaranteed_renewable":false,"tags":["大公司品牌","重疾险","疾病保险","健康险","轻症保障","终身保障"],"competitive_edge":["120种重疾+60种轻症、身故保障、被保险人轻症豁免","轻症保障","大公司品牌（服务有保障）"],"delisting_reason":"市场策略调整","validity_status":"已停售","renewal_terms":"To renew 国寿福终身寿险（庆典版），policyholders must be under 70 years old. Renewal requires meeting health and financial conditions set by the insurer. The exact age limit and conditions may vary.","health_disclosure":"For 国寿福终身寿险（庆典版），health disclosure is mandatory; accurate medical history is required for policy approval; any significant health issues must be reported."},{"id":"crx-kangning-zunxiang","name":"康宁尊享终身重疾险","company":"中国人寿","type":"重疾险","subtype":"终身重疾多次赔付","premium_per_10k":292,"min_coverage":10,"max_coverage":50,"coverage_period":"终身","waiting_period":"180天","key_benefits":["120种重疾分6组最高赔6次","40种轻症赔20%x6次","20种中介赔50%x2次","15种少儿特疾额外赔100%"],"premium_type":"均衡保费","notes":"旗舰多次赔付产品，少儿特疾额外赔","category":"个人","listing_time":"2024-01","delisting_time":"仍在售","sales_channel":"个险|银保|经纪","is_active":true,"popularity_score":4,"premium_30m_20y":5840,"premium_30f_20y":5139,"payment_term":"20年","payment_choices":["趸交","3年","5年","10年","15年","20年"],"highlights":"重疾分6组最高赔6次，120种重疾+轻症全覆盖，多 ...[truncated 28 chars]
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: {"products":[{"id":"crx-guopao","name":"国寿福终身寿险（庆典版）","company":"中国人寿","type":"重疾险","subtype":"终身重疾","premium_per_10k":3079,"min_coverage":10,"max_coverage":50,"coverage_period":"终身","waiting_period":"180天","key_benefits":["120种重疾+60种轻症","身故保障","被保险人轻症豁免"],"premium_type":"均衡保费","notes":"大公司品牌，重疾保障全面","category":"个人","listing_time":"2018-07","delisting_time":"2021-12","sales_channel":"银保|个险|经纪","is_active":false,"popularity_score":2,"premium_30m_20y":61580,"premium_30f_20y":54190,"payment_term":"20年","payment_choices":["趸交","3年","5年","10年","15年","20年"],"suitable_for":"25-50岁家庭经济支柱，基础健康保障规划","highlights":"120种重疾+60种轻症、身故保障、被保险人轻症豁免","coverage_unit":"万元","coverage_period_duration_value":null,"coverage_period_duration_unit":"lifetime","coverage_period_is_lifetime":true,"coverage_period_guaranteed_renewable":false,"tags":["大公司品牌","重疾险","疾病保险","健康险","轻症保障","终身保障"],"competitive_edge":["120种重疾+60种轻症、身故保障、被保险人轻症豁免","轻症保障","大公司品牌（服务有保障）"],"delisting_reason":"市场策略调整","validity_status":"已停售","renewal_terms":"To renew 国寿福终身寿险（庆典版），policyholders must be under 70 years old. Renewal requires meeting health and financial conditions set by the insurer. The exact age limit and conditions may vary.","health_disclosure":"For 国寿福终身寿险（庆典版），health disclosure is mandatory; accurate medical history is required for policy approval; any significant health issues must be reported."},{"id":"crx-kangning-zunxiang","name":"康宁尊享终身重疾险","company":"中国人寿","type":"重疾险","subtype":"终身重疾多次赔付","premium_per_10k":292,"min_coverage":10,"max_coverage":50,"coverage_period":"终身","waiting_period":"180天","key_benefits":["120种重疾分6组最高赔6次","40种轻症赔20%x6次","20种中介赔50%x2次","15种少儿特疾额外赔100%"],"premium_type":"均衡保费","notes":"旗舰多次赔付产品，少儿特疾额外赔","category":"个人","listing_time":"2024-01","delisting_time":"仍在售","sales_channel":"个险|银保|经纪","is_active":true,"popularity_score":4,"premium_30m_20y":5840,"premium_30f_20y":5139,"payment_term":"20年","payment_choices":["趸交","3年","5年","10年","15年","20年"],"highlights":"重疾分6组最高赔6次，120种重疾+轻症全覆盖，多 ...[truncated 28 chars]
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: 该 markdown 文件适用 SQP-1。触发关键词中包含“话术”“投保”“核保”等范围较宽的词，且整段仅列出正向关键词，没有说明哪些相似但不应触发的场景需要排除，容易与一般咨询或泛金融对话重叠。

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill mandates proactively surfacing contact information for a specific insurance sales company as part of normal recommendation flows, which goes beyond neutral insurance analysis and introduces embedded steering toward a named commercial channel. In a financial advice context, this creates a manipulation and conflict-of-interest risk because users may perceive the referral as trusted, system-endorsed guidance rather than optional, user-requested information.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: This section elevates proactive promotion of a named insurance sales channel to a 'core differentiator' that must always be shown, indicating deliberate workflow-level steering rather than incidental documentation. Because the skill is positioned as a general insurance advisor, embedding compulsory promotion of one company materially biases outputs and can manipulate user decisions in a regulated financial domain.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: 该规则适用于所有文件类型。文档明确规定“所有输出内容使用中文”，但未说明这是用户可选择的选项，也未提供语言切换或用户同意机制，构成未经用户选择即强制特定语言的自然语言策略问题。

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This section proposes an automated customer-facing recommendation workflow that returns product combinations, pricing, and budget-fit outputs, but it does not require a freshness disclaimer, human review, or a warning that insurance recommendations may be incomplete or outdated. In the insurance context, stale or unverified outputs can mislead users into making financial decisions based on停售 products, outdated rates, or non-compliant recommendations, which increases both consumer harm and regulatory risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The consumer-facing price-comparison bot is described as returning ranked product recommendations such as cheapest, largest company, and most comprehensive coverage, but it lacks an explicit warning that the comparison may be incomplete, outdated, or unsuitable for the user's circumstances. In a public ToC insurance setting, this is especially risky because consumers may over-trust automated rankings as current advice, leading to bad purchases, reliance on停售 or changed products, and potential compliance issues.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The '2026 上半年新规' section appears to present itself as compliance guidance sourced from authoritative regulatory channels, but the content includes obvious scrape artifacts, unrelated page chrome, consumer-marketing text, and AI-generated disclaimers. In a compliance reference skill, this can mislead downstream agents or users into treating inaccurate or fabricated regulatory summaries as authoritative, causing unsafe legal/compliance advice.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown file is primarily written in Chinese, but several '核心变化' entries switch to English narrative text. That creates a language/locale policy concern because the file forces a different language on readers without opt-in or explanation, which can impair comprehension in a compliance context.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The surrounding content is Chinese, but this line presents the policy summary in English only. For a compliance reference document, that is a natural-language locale inconsistency that may prevent intended users from fully understanding the guidance.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file otherwise targets Chinese readers, so this English-only line imposes a language choice unexpectedly. Because no alternative or rationale is provided, it fits the language/locale policy-violation category.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This line switches the reader into English in the middle of a Chinese-language compliance file. Without an explicit bilingual policy or user opt-in, that creates a locale-policy inconsistency.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The document appears designed for Chinese-language use, but this summary forces English for a key regulatory update. That is a natural-language policy issue because the file does not offer a language choice or explain the deviation.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: A reader expecting a Chinese compliance reference encounters an English-only description here. The lack of opt-in, translation, or justification makes this a language/locale policy violation under the applicable rule.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file's primary language is Chinese, yet this policy update is summarized only in English. Because the document does not offer language choice or explain a bilingual requirement, this is a policy-level locale inconsistency.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This line presents a key regulatory change in English even though the surrounding section is Chinese. In a compliance-oriented markdown file, that unexplained language switch is a natural-language policy concern.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The document otherwise communicates in Chinese, but this line requires readers to switch languages to understand the update. Without explicit opt-in or a stated bilingual policy, that violates the language/locale guidance.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This English-only line breaks the document's apparent Chinese-language convention and may reduce usability for its intended audience. No note explains why English is used or offers an alternative language path.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is intended only for Chinese-speaking users or a China-specific deployment. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The markdown states fixed male and female pricing factors and concludes the data can be 'safely used' for product comparison and rate recommendations. This embeds a hard gender-based treatment in natural-language guidance without any opt-in, user choice, or documented justification for the locale/policy constraint.

Static analysis

No suspicious patterns detected.