Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-related but asks for broad local, web, memory, session, and scheduling powers without enough scoping, and it includes unsafe setup and generated-HTML patterns.
Install only if you are comfortable reviewing prompts and commands first, limiting tool permissions where possible, and avoiding confidential content in generated HTML mind maps until the CDN dependency and HTML escaping issues are fixed. Do not run the documented curl | sh command without independent verification.
REQUIREMENTS.md:100Remote Rust Installer Is Downloaded and Executed Without Verification
teams/xiaodi-office-team/scripts/mindmap.py:172Generated Mind-Map Documents Load Mutable Third-Party JavaScript
teams/xiaodi-office-team/scripts/mindmap.py:155User-Derived Content Is Inserted Into Generated HTML Without Contextual Escaping
SKILL.md:8Agent Tool Allowlist Exceeds the Minimum Privileges Required by Declared Workflows
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg
# macOS
brew install ffmpeg
The '| sh' pattern is especially dangerous because it turns a network fetch directly into immediate shell execution, removing the opportunity for inspection or integrity validation. In a skill that already expects command-line setup and may have access to powerful tools, this increases the chance of users running unsafe bootstrap code and suffering host compromise.
# 安装 Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
# 然后安装 whisper
pip install openai-whisper
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
If the implementation is only mind-map generation and file output, representing it as a four-team intelligent switcher is materially inaccurate. This discrepancy can conceal data flow and side effects, which is a legitimate security concern even absent overtly malicious code.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
根据用户需求，选择合适的角色来处理任务。每个角色都有专业能力，协作完成任务。
"""
return prompt
def process_user_input(user_input: str) -> dict:
The only natural-language examples are in Chinese, and the README presents them as the way the switcher routes requests without indicating multilingual support or user language preference. This can constitute a language/locale policy issue because the skill appears to assume a specific language without opt-in or justification.
The README states that the Switcher 'automatically routes to the right team' but does not define activation boundaries, confirmation steps, or exclusions for risky domains. In a multi-tool system with web_search, exec, and browser access, overly broad routing can misclassify user intent and send requests to a team that may invoke more capable or risky tooling than necessary.
This markdown file uses Chinese throughout for installation and usage instructions, which can amount to a language/locale policy violation when no user opt-in or alternative language is provided. The policy explicitly flags skills that force a specific language without user choice.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg
# macOS
brew install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg
# macOS
brew install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg
# macOS
brew install ffmpeg
Without declared permissions the skill's intent is opaque and cannot be validated.
The invocation examples are very broad and provide no trigger constraints, exclusions, or safety boundaries despite the skill requesting sensitive capabilities such as exec and browser. In this context, overly broad prompts increase the chance of unintended activation on risky tasks, especially local media/file operations and web interactions.
The README shows very broad natural-language activation examples like '帮我选品' and '计算这个产品的利润率' without any explicit scoping, invocation syntax, or confirmation boundaries. In an agent ecosystem, overly generic triggers can cause accidental activation or routing from unrelated user messages, increasing the chance the skill processes sensitive business data or performs unintended actions.
The example trigger uses ordinary natural language ('帮我选品…') without any explicit invocation boundary, making it easy for unrelated user requests to accidentally activate this skill. In a multi-skill system, broad triggers can cause unintended routing to web-enabled commerce functions, increasing the chance of over-collection, unnecessary external fetching, or execution in the wrong context.
The monitoring description promises automated competitor tracking ('每日定时抓取', price-change alerts, coupon tracking) but does not define who can enable it, what targets are allowed, or the operational limits. In a tool-enabled agent environment, this ambiguity can lead to persistent or repeated scraping behavior beyond user intent, creating abuse, policy, and compliance risk.
This manifest is written entirely in Chinese for role names, descriptions, capabilities, workflow names, and data-source labels, indicating a fixed language/locale expectation. The file does not offer any user opt-in, alternative language selection, or documented region-specific justification for this constraint.
The pricing specialist has the exec tool despite a role limited to pricing strategy, profit calculation, and competitor price tracking. Granting code execution to an agent that processes external market data increases the risk of arbitrary command execution, tool misuse, or indirect prompt injection leading to local actions beyond its business purpose.
No suspicious patterns detected.