Security audit

Agent Onboarding 1.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks agents to install and auto-update skills, create recurring cron jobs, and uses embedded folder tokens without enough scoping or safeguards.

Install only in an authorized environment after reviewing the referenced dependencies and cron jobs. Require pinned trusted skill versions, documented cron commands and removal steps, integrity checks for updates, and confirmation before overwriting _config. Treat the listed folder tokens as sensitive unless the service confirms they are only non-secret identifiers protected by separate authentication.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:43
Finding: Mandatory Daily Cron Jobs Establish Cross-Session Persistence
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Required Skill Dependencies Lack Version and Source Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: Workspace Resource Tokens Are Embedded in a Distributable Skill
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description, title, and operational instructions are presented exclusively in Chinese, including the capability announcement instruction, without offering users a language or locale option. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill embeds shared folder tokens directly in the document and provides no handling guidance, sensitivity warning, or access-control caveat. Even if these are only identifiers, publishing resource tokens in broadly distributed onboarding content increases the chance of unauthorized discovery, misuse, or accidental disclosure of internal shared resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to create a local _config directory and maintain files, including an overwrite-style daily sync, without any explicit warning, confirmation step, or scope limitation. This can lead to unintended workspace modification or clobbering of existing files, especially because the cron task says to '覆盖更新' (overwrite update), making the behavior operationally risky even if not overtly malicious.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.