Security audit

02 Risk Scoring

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only internal risk-scoring guide with expected data collection for its purpose and no executable, persistence, or hidden behavior found.

Before installing, treat this as an internal decision-support template, not an automated enforcement tool. Redact customer names, contact details, case IDs, and other unnecessary identifiers before pasting records, and keep any suspension or termination decisions under human review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 该段将“粘贴供应商/站点的运营数据”“描述具体问题并要求综合判断”等表述列为触发条件，但没有限定必须是风险评分场景，也没有给出排除条件或更具体的触发短语。这类宽泛描述容易与日常分析、咨询或一般性问题重叠，造成技能激活边界不清。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly solicits complaint records, violation records, KPI reports, and operational data, which may contain personal data, commercially sensitive information, or internal compliance details, but it provides no minimization, masking, consent, retention, or handling guidance. In a risk-evaluation context, this increases the chance that users paste raw sensitive records into the model unnecessarily, creating privacy and confidentiality exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown skill uses Chinese throughout its instructions and outputs, but does not state that the skill is region-specific or give users an option to choose language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: 该技能从角色说明、流程到输出模板均默认要求中文交互，未见允许用户选择其他语言或说明该中文限制的业务理由。根据语言/地区政策，强制单一语言而无用户选择可能构成自然语言层面的政策问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.