Security audit

人虾协作开发工作流

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed, local Markdown workflow skill that changes an agent’s development process but does not add hidden execution, credential access, telemetry, or unrelated data handling.

Install this only if you want a structured, gate-heavy coding workflow that may ask clarifying questions and require design or verification steps before coding. Review the broad triggers and Chinese-first instructions if you prefer lighter, explicitly invoked workflows.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger description is extremely broad and explicitly says the workflow should activate even when the user did not ask to 'use the workflow,' covering generic requests like development, bug fixes, refactors, and even proposal self-checks. This can cause the skill to hijack normal interactions, override user intent, and impose hidden process constraints across many unrelated requests, increasing the chance of unsafe or unintended behavior.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The documented trigger phrases are generic enough that an agent could activate the workflow in situations the user did not intend, especially if the host platform performs loose natural-language matching. In this skill, activation can materially change agent behavior by imposing a hard-gated process and steering planning/coding flow, so accidental invocation can cause unintended execution paths, prompt hijacking of normal tasks, or denial-of-intent through unnecessary workflow takeover.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The quick-start examples use ordinary conversational phrases like 'Help me develop a new feature' and 'Help me create a new Skill', which increases the chance of unintentional activation during routine discussion. Because this is an agent-control skill rather than passive documentation, broad examples make the surrounding context more dangerous: they can override a user's expected lightweight interaction model and force a more powerful or constraining workflow than requested.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases shown here are broad, common development requests such as creating a new feature or writing code. In agent platforms that activate skills from natural-language matching, overly generic triggers can cause this workflow to engage unintentionally, changing the agent's behavior, adding hidden process constraints, or steering unrelated tasks into this skill.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Describing activation as 'natural language trigger' without defining boundaries leaves the invocation condition ambiguous. In practice, this can lead to accidental activation from ordinary conversation, making the agent apply workflow rules unexpectedly and potentially overriding user intent or interfering with other installed skills.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The skill name, display name, tags, and body strongly bias operation toward Chinese-language interaction without stating that language should follow user preference. Forcing a language or locale can mis-handle user requests, degrade comprehension of security-sensitive instructions, and create consent/usability issues when the user expects another language.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The entire skill reference is written only in Chinese and provides no indication that language choice is optional or that the locale restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file presents all instructions and guidance exclusively in Chinese, which can constitute a language/locale policy violation when no user choice or opt-in is provided. The file does not document that the locale is intentionally region-specific or offer an alternative language.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title and all operational templates are written as mandatory Chinese instructions, and the file gives no indication that other languages are supported or that Chinese is required for a specific regional or compliance reason. This creates a natural-language locale constraint without user opt-in, which matches the policy-violation category.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: “语言 | 中文（主），英文（README）”表述显示该技能默认以中文为主，但未说明是否支持根据用户偏好切换输出语言，也未体现语言选择的显式 opt-in。按语言/locale 政策，这属于可能的默认语言强制。

Static analysis

No suspicious patterns detected.