Security audit

Pitch Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a pitch-strategy skill with mostly coherent behavior, but it asks users for internal informant information about client decision-makers without confidentiality or legality boundaries.

Review this skill before installing if you work on procurement, RFPs, or regulated client pitches. Use only public, authorized, and non-confidential information, and do not solicit or provide insider details about evaluation teams, private preferences, unpublished scoring, or company-confidential decision processes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger scope is extremely broad and explicitly includes vague everyday phrases such as '帮我做个提案', '客户要方案', and '怎么才能赢', which can cause the skill to activate outside the intended competitive pitch/RFP context. In an agentic system, over-triggering is dangerous because it can silently route unrelated business conversations into a specialized persuasion/competition workflow, leading to inappropriate advice, context capture, and unintended downstream agent execution.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The line explicitly asks whether the user has an internal contact who can provide information, directly encouraging acquisition of insider-provided nonpublic intelligence about decision-makers. In a pitch/RFP setting, that is especially dangerous because it can facilitate unfair procurement advantage, misuse of confidential business information, privacy violations, and downstream legal or reputational harm.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file contains a natural-language rule that determines output language automatically: deliverables must match upstream agent output language, with specific mandatory exceptions for English-facing proposals. This is a locale/language policy constraint without any user opt-in or explicit choice mechanism, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly states that AIGC prompts 'must be in English', which is a language constraint expressed in natural language. Under the policy, forcing a specific language without user choice or clear region-specific justification is a policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill asks the user whether there is an internal source who can provide information about evaluation-team members, but it gives no boundaries about legality, confidentiality, privacy, or acceptable sourcing. In a competitive bidding context, this can steer users toward collecting or using nonpublic insider information about decision-makers, which may violate company policy, NDAs, procurement rules, or anti-corruption expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural language content. This markdown file presents all operational guidance in Chinese and does not indicate that users may choose another language or that the language restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly states that prompts 'must be English,' which imposes a language requirement as a policy decision rather than offering the user a choice. Under the language/locale policy rule, this is a natural-language policy violation because no opt-in or region/tool-specific exception is documented beyond a performance preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description and vibe fields force Chinese-language content in the skill's natural-language metadata, which may violate a language/locale policy if users are not expecting Chinese by default. Although L12 says output should match the user's language, the top-level descriptive text itself does not provide a choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents all instructions, headings, and templates exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.