Back to skill

Security audit

AI+消费创新大赛报名助手

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only competition application helper whose behavior is disclosed and aligned with its stated purpose.

Before installing, understand that this skill is tailored to a Chinese-language Shanghai competition and may ask for sensitive project, team, business, and compliance details so it can draft application guidance. It includes an official-looking email and phone number for submission guidance, but it does not automatically send anything; users should verify contest details through official channels before sharing materials.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains all user-facing instructions in Chinese and does not indicate that users may choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale-policy concern unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

A natural-language policy violation applies across all file types when a skill effectively forces a specific language or locale without user opt-in. This guide is fully Chinese-language and does not indicate that the user may choose another language or that the content is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file title and all report templates are written as mandatory Chinese output formats, indicating the skill is expected to produce results in Chinese by default. Because there is no user opt-in, alternative language option, or documented region-specific justification in this file, it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

该 markdown 文件全文以中文编写,且未看到对语言选择、可切换语言或适用区域的说明。按规则,若技能强制特定语言而没有用户选择或明确合理说明,可能属于自然语言层面的策略违例。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing guidance exclusively in Chinese, and nowhere indicates that users may choose another language or that the content is intentionally limited to a Chinese-language audience. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.