Security audit

Remove-AI sence（去除AI味）

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed UI cleanup tasks on frontend project files and shows no evidence of hidden, exfiltrating, destructive, or persistence behavior.

Install only if you want a Chinese-language UI cleanup workflow that scans frontend files and may modify project code after review. Run it in a version-controlled project and review the generated report before approving replacements, especially for user-facing error text and localization-sensitive applications.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Hidden Instructions

High

Category: Prompt Injection
Content: --- name: de-ai description: 自动扫描项目生成HTML检测报告，检测AI常用色、Emoji图标、英文报错暴露，支持一键替换为专业品牌风格。触发词：去掉AI味道、UI美化、专业化、统一配色、去除AI味、de-ai、品牌风格 version: 1.0.0
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: --- name: de-ai description: 自动扫描项目生成HTML检测报告，检测AI常用色、Emoji图标、英文报错暴露，支持一键替换为专业品牌风格。触发词：去掉AI味道、UI美化、专业化、统一配色、去除AI味、de-ai、品牌风格 version: 1.0.0
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The README instructs users to invoke the skill using Chinese phrasing ("帮我去掉这个项目的AI味道") and all user-facing documentation is written only in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and justified. This creates a natural-language locale constraint without user opt-in, which matches the language policy violation category.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases are broad design terms like 'UI美化' and '专业化', which can cause the skill to activate in situations where the user did not intend repository scanning or modification. In this skill, that broad activation is more concerning because the workflow includes generating files, opening a browser, and later editing project files.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The usage section defines activation conditions in subjective terms like '看起来像 AI 生成的', which leaves too much room for the agent to infer applicability from ordinary design requests. Because the skill then prescribes filesystem writes and automated replacements, ambiguous activation increases the risk of unexpected actions on a user's project.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: Mandating Chinese-language report output without checking the user's locale or preference can create misleading or unusable artifacts for teams that work in another language. In a codebase automation skill, forced language choices can also affect user-visible text and documentation quality across multilingual environments.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The skill directs replacement of exposed errors with Chinese-only messages, which can alter user-facing application behavior without locale awareness or product approval. In production applications this can degrade usability, break localization expectations, and cause inconsistent error handling across markets.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill requires creating an HTML report in the project root and opening it in a browser, but does not require prior disclosure and consent for those side effects. Even if the actions are not inherently malicious, silent file creation and tool invocation can surprise users and alter working directories or local state unexpectedly.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill instructs creating a `.claude/ui-spec.md` file without clearly warning the user in advance that the repository will be modified. Unannounced documentation writes are risky in automation contexts because they can dirty a working tree, conflict with repo conventions, or leak generated content into version control.

Static analysis

No suspicious patterns detected.