T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
WORKFLOW.md:22- Finding
Excessive Employee Surveillance and Sensitive Profiling
- Content
View full analysis
- Remediation
View remediation
Security audit
HR谈心罗盘
Security checks for vulnerabilities and agentic risk
Overview
This is a prompt-only HR coaching skill, but it asks users to create and aggregate sensitive employee profiles and risk records without enough governance controls.
Install only if your organization already has an approved HR/AI data-processing process. Use coded and minimized inputs, avoid raw quotes when possible, keep EAP/legal/medical matters out of general AI summaries, restrict access, define retention/deletion, and do not use the generated risk labels as the basis for employment decisions without qualified human review.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
prompts/review-insights.md:62- Finding
Unsafe Long-Term Retention and Aggregation of Sensitive HR Records
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow explicitly instructs storing employee conversation records, preserving verbatim statements, and feeding accumulated reports into AI for monthly/quarterly analysis, but provides no safeguards around consent, minimization, de-identification, retention, access control, or approved processing boundaries. In an HR context, these notes are highly sensitive personnel data and may include health, emotional state, family/relationship details, performance signals, and attrition risk, so sending them to AI or broadly archiving them can create serious privacy, legal, and insider-misuse risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states the agent will automatically load this skill when conversations involve broadly defined HR topics such as employee 1:1s, retention interviews, and similar themes. Broad auto-activation can cause the skill to be invoked in contexts where the user did not request HR coaching, which increases the chance of unsolicited behavioral guidance, inappropriate data collection prompts, or context hijacking in ordinary workplace conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill declares that all advice must comply with 'common knowledge of Chinese labor law' without scoping this to users in China or offering jurisdiction selection. In a multi-region deployment, this can produce legally inappropriate guidance and mislead users into applying the wrong employment-law assumptions to sensitive personnel actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and the entire skill content are written exclusively in Chinese, and there is no indication that users may choose another language or that the skill is limited to a China-specific deployment context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt hard-codes Chinese as the interaction language and does not ask for or adapt to the user's preferred language. In an HR context, this can exclude users, cause misunderstandings in sensitive employee conversations, and reduce safe/accurate use when the operator is more comfortable in another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Line L39 explicitly requires '全中文', which is a language constraint in the skill's natural-language instructions. The file does not offer a user opt-in or alternative language choice, and no region-specific or compliance-based justification is provided.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This plain-text skill file defines behavior and workflow but does not state when the skill should be invoked, what exact user requests should trigger it, or any exclusion conditions. Without explicit trigger scope or negative examples, the skill could be applied to loosely related HR conversations more broadly than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction '全中文' forces a specific language regardless of user preference. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is present here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger words "单场" and "汇总" are overly generic and can easily appear in ordinary conversation, increasing the chance that the skill activates in the wrong context or switches analysis modes unintentionally. In an HR workflow, accidental invocation can cause the model to process sensitive employee conversation content under the wrong analytical frame, producing privacy-impacting summaries or organizational inferences the user did not intend to request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L48 states "全中文" as a hard rule, which forces a specific language for all interactions. This is a natural-language policy concern because the file does not present the language requirement as optional or region-justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L58 states '全中文', which forces a specific language regardless of user preference. This is a natural-language policy concern because the file does not provide any opt-in, fallback, or justification for restricting output to Chinese only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains user-facing change descriptions entirely in Chinese, including section headers and feature notes. Under the language/locale policy rule, forcing or assuming a specific language without documenting user choice can be a policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
SQP-3 适用于所有文件类型。全文以中文固定角色和中文交互说明编写，默认要求按中文语境执行，但没有声明可根据用户偏好切换语言，也没有说明这是仅适用于特定中文区域或组织环境的限定场景，因此存在未获用户选择即限定语言/locale 的政策风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire prompt and usage guidance are written in Chinese and instruct the assistant to respond in that mode for managers, but there is no indication that the user can choose another language. This creates a natural-language locale constraint without documented opt-in or justification in the file itself.
- Content