Security audit

智能需求解读器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a self-contained requirement-analysis helper with no network, credential, or durable data-collection behavior found, though it does keep short-lived in-memory interaction history.

Install only if you are comfortable with the skill analyzing requirement text locally. Avoid putting secrets, credentials, or highly confidential details into requirements, because the interpreter object keeps a capped in-memory history during its process lifetime and can return recent entries through its insights method.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The skill maintains an internal learning/analytics log that goes beyond the stated requirement-interpretation purpose, creating hidden data-retention behavior. In this context, requirement text may contain sensitive business plans, technical details, or personal information, so undisclosed logging increases privacy and data-governance risk.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The analytics function profiles users' requirement types, industries, urgency, and exposes recent interactions, which can reveal sensitive operational priorities and user-submitted content. Because this capability is not clearly required for the advertised task, it expands the privacy attack surface and can leak business-sensitive metadata.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The documented purpose omits the learning/logging behavior, which makes the component less transparent about its handling of user data. While documentation mismatch alone is not severe, in a requirement-interpreter skill it can cause users to share sensitive material without understanding it is being stored and analyzed.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README states the skill will auto-start whenever a requirement description is 'vague', but that condition is subjective and undefined. In an agent environment, broad auto-triggering can cause the skill to activate unexpectedly on ordinary user inputs, leading to prompt routing errors, unnecessary data exposure to the skill, or disruption of intended workflows.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The manual invocation phrase is generic everyday language ('help me analyze this requirement in detail'), which may overlap with normal conversation rather than an intentional skill call. This increases the chance of accidental invocation, causing the agent to enter the skill unexpectedly and potentially process user content under the wrong context.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad and overlap with many normal user interactions, such as vague requests, urgent requests, or requests needing clarification. Over-broad activation can cause the skill to engage unexpectedly, which may lead to unnecessary collection of user context, workflow interference, or misuse in conversations where the user did not intend to invoke this behavior.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: User requirements are stored in an internal log without warning or consent. Requirement submissions often include confidential business requirements, credentials-by-mistake, customer data, or incident details, so retaining raw text materially increases privacy and compliance risk if the process memory is exposed or reused.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The code stores full user requirements and later returns recent interactions via the learning-insights API, creating a direct data exposure path. In this skill context, those requirements can contain commercially sensitive plans or personal data, so exposing recent raw inputs makes accidental disclosure significantly more dangerous.

Static analysis

No suspicious patterns detected.