Security audit

Q12敬业度调研助手

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only Q12 employee engagement survey helper, with some privacy wording users should read carefully around the docs and landing page.

Suitable to install as a prompt-only methodology skill. Use anonymized or aggregate survey data, avoid small teams where anonymity cannot be protected, and do not paste identifiable employee responses unless your AI environment is approved for that HR data. The skill itself has no executable code, but rendering the README, SVG, or landing page may contact third-party services, so do not rely on the docs/site as completely network-isolated.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The workflow triggers include very generic phrases such as 'What is Q12' and 'Tell me about Gallup', which can overlap with normal conversation and cause unintended activation of the skill. In a prompt-skill setting, accidental routing can expose user HR-related context to the wrong skill behavior, produce irrelevant guidance, or interfere with the assistant’s intended task selection.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The workflow trigger phrases include broad natural-language expressions such as “我要做敬业度调研”, “我拿到数据了”, and “低分怎么改”, which are plausible in ordinary conversation and may activate the skill unintentionally. In an agent environment, accidental activation can cause the model to switch into this skill’s workflow unexpectedly, leading to irrelevant guidance, context hijacking, or exposure of user-provided HR survey data to the wrong prompt logic.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as generally public-facing, but it does not state that use is limited to Chinese-speaking users or offer an opt-in language choice. Under the language/locale policy, a skill should not implicitly force a specific language unless the constraint is explicit and justified.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The page claims '100% local/完全本地', but it embeds and links to multiple third-party services, including externally hosted badge images and outbound links to GitHub, WeChat, Xiaohongshu, JD, and the skill hub. This is dangerous because it can mislead users about privacy and network isolation: merely loading the page may disclose IP address, user agent, referrer, and browsing activity to third parties, which is especially sensitive in an HR/employee-survey context.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The comment and code explicitly state that the page always defaults to Chinese on fresh load and does not restore localStorage or browser language. This is a natural-language locale policy issue because the skill imposes a specific language by default rather than honoring user choice or obtaining opt-in.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The technical specs declare "Languages | English + Chinese" as a fixed locale constraint, but the document does not explicitly state that users may choose their preferred language for interaction or output. Under the policy, language restrictions should be opt-in or clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: 文件整体为中文 README，且技术规格仅写“语言 | 中文 + 英文”，但没有说明技能在实际响应时如何根据用户偏好选择语言，也未给出显式 opt-in 机制。对于面向多语言助手的技能，这可能形成默认语言/locale 偏置。

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The SVG embeds an external image from avatars.githubusercontent.com, which causes client-side network requests when the asset is rendered. That can leak viewer IP address, user agent, referrer/context, and create a dependency on third-party availability for a skill asset unrelated to the survey function.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: This SVG contains hard-coded English UI text such as "Star History," "Date," and "GitHub Stars," which imposes a specific language in user-visible output. The file does not provide any indication of localization, user choice, or documented justification for English-only rendering.

Static analysis

No suspicious patterns detected.