Security audit

Anti-Hallucination

Security checks for vulnerabilities and agentic risk

Overview

The skill tries to reduce hallucinations, but it broadly tells agents to automatically inspect files, search the web, visit URLs, and run code without enough scoping or user control.

Review this skill before installing if your agent has shell, filesystem, or network tools enabled. It is not malicious based on the inspected artifacts, but you should disable automatic code execution or require approval before running code, visiting arbitrary URLs, searching broadly, or adding the rules to persistent agent instruction files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly describes executing detected code in a sandbox, but provides no user-facing warning, consent step, or policy constraints around what code may be run. Even in a sandbox, executing model-detected code can expose the system to resource abuse, sensitive data access within the sandbox boundary, network misuse, or execution of adversarial payloads embedded in otherwise normal-looking content.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file path trigger includes the regex '/' which matches almost any text containing a slash, including URLs, dates, code, markdown, and normal prose. This makes the hook fire far too often and can cascade into unintended path verification behavior, noisy annotations, and unnecessary filesystem-oriented actions in contexts that were never meant to be treated as paths.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file describes when the skill should be used, and the stated scope covers extremely broad, everyday contexts rather than a narrowly bounded trigger condition. Because it does not provide exclusion conditions or negative examples, the invocation boundary is ambiguous and could cause unintended over-activation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: These trigger conditions match extremely common content that appears in many normal interactions, so the skill's auto-trigger boundary is unclear. The file does not specify thresholds, exclusions, or negative examples to clarify when verification should or should not be triggered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L03 instructs the operator in Chinese, and the embedded prompt rules throughout the file require responses and labels in Chinese phrasing such as "我不确定，需要确认" and "❓ 未经验证". The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-speaking context, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API detection patterns, especially generic expressions like \w+.\w+(, are so broad that they will match common programming syntax in many benign snippets. In this skill, those matches feed an automated verification pipeline, which increases the chance of false triggering, wasted analysis, and unsafe follow-on behavior if verification includes external lookups or execution-related handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The hook is configured with auto_trigger enabled and the documented detection flow starts by scanning all output for code-like patterns. Because the activation conditions are broad, ordinary content can trigger verification unexpectedly, causing unnecessary processing and potentially invoking downstream actions on content that was not meant to be executed or analyzed deeply.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The hook descriptions and trigger conditions are underspecified and broad, which makes activation ambiguous across normal conversational and code content. In a security-sensitive agent, ambiguous hook criteria can lead to unpredictable tool use, excessive verification, and easier abuse by crafted inputs that intentionally trigger costly or privacy-impacting checks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The hook is configured with auto_trigger enabled and is paired with very broad trigger patterns, so it can activate on ordinary outputs rather than only on high-risk factual claims. In an agent pipeline this can cause excessive verification actions, unnecessary external lookups, and workflow disruption, which expands attack surface and can be abused for denial-of-service-style behavior or unwanted tool invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill is written as a prescriptive rule set in Chinese and does not offer any language or locale choice for users. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file title and all operational instructions are written exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The date/time trigger list is broad enough to activate on many ordinary prompts, which can cause unnecessary command execution before answering. In an agent setting, overbroad automatic tool use expands the attack surface and can be abused to steer the agent into running local commands when simple conversational handling would suffice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Numeric/statistical keywords such as '多少' or '平均' are extremely common and may trigger file reads or script execution in contexts that do not require trusted data retrieval. This creates unnecessary tool invocation and raises the risk of prompt-driven resource use, unintended data exposure, or agent misbehavior from loosely scoped automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code/API rule instructs the agent to use grep, websearch, and even 'run it to verify' based on ambiguous trigger words like '函数名' or 'API'. This is dangerous because it can drive execution of code or external lookups from minimally specific prompts, increasing the risk of executing unsafe code, following malicious dependency paths, or leaking information through network access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Generic file/path keywords can cause the agent to probe the filesystem whenever users mention files, directories, or locations in normal conversation. In a privileged environment, this may disclose system structure or encourage unnecessary filesystem access that an attacker could trigger through innocuous wording.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The citation/source rule mandates searching and visiting URLs whenever broad source-related terms appear, which can push the agent into network access and URL validation on weak prompting. That behavior is risky because malicious prompts may induce requests to attacker-controlled URLs, enabling SSRF-like access patterns, metadata exposure, or unsafe browsing by the agent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring and user-facing descriptions are written entirely in Chinese, and there is no indication that the skill supports language choice or that Chinese is a justified locale requirement. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring presents the description and usage in Chinese, and later user-facing messages are also Chinese-only. This creates a language/locale constraint without offering opt-in, selection, or documenting a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report text shown to users is emitted exclusively in Chinese, which forces a specific locale in normal operation. The file does not provide any option for users to choose another language or explain a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file consistently presents content in Chinese and English and does not indicate that users may choose their preferred language. Under the language/locale policy, forcing a specific language or locale presentation without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These words are common in ordinary conversation and writing, so using them as activation triggers can lead to frequent unintended invocation. The document does not sufficiently limit the trigger to particular contexts or provide exclusion guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest presents the main description in Chinese while English is relegated to a secondary description_en field. For organizational language/locale policy, this can be a natural-language constraint if consumers of the manifest are expected to use the primary description and no user opt-in or locale justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.