Back to skill

Security audit

Lord Of Mysteries 诡秘之主

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese Lord of the Mysteries lore reference; it includes some fictional hazardous rituals and violence, but it does not run code or request hidden authority.

Install this only if you want a Chinese-language Lord of the Mysteries lore lookup skill. Treat potion formulas, rituals, weapons, body-horror, mind-control, and creature-hunting passages as fictional reference material, not instructions to attempt in real life.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (86)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file includes explicit instructions to collect fresh blood, heat it, and drink the resulting mixture, which could seriously affect user health and safety. Under the markdown-specific warning rule, the document should visibly warn users about bodily harm, biohazards, and not attempting the procedure, but no such warning appears near the instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

These lines specify quantities of parrot feathers, tongue, nails, blood, water, and boiling steps to create a potion, but the markdown omits any disclosure about animal welfare concerns, contamination, or risks from handling and consuming biological matter. Because the behavior could affect health and potentially involve harm to animals, a user-facing warning is expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
91% confidence
Finding

L23明确指出薄荷膏对鱼人是“致命的血液性毒素”,并说明可用于捕猎鱼人。这种自然语言描述直接传达了将特定物质作为致命伤害工具的用途,超出了普通食物介绍范围。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

L29以指令式自然语言详细描述了如何引诱、削弱并用带毒武器猎杀鱼人,属于可操作的暴力伤害内容。该内容不是单纯背景设定或食物描述,而是提供了具体实施步骤,构成明显的自然语言安全风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Line L11 says '我及我之所见,皆为女性', which describes a blanket transformation or reclassification of all seen entities as female. This violates the policy category on natural-language language/locale-style constraints by imposing a universal gender rule without offering choice or a justified narrow context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language instruction explicitly directs the role to bring sexual pleasure to men and women and use it to control or influence them. This is a policy-relevant behavioral directive expressed in the file content, not merely neutral world-building detail, and it provides no user opt-in, consent, or limiting context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file describes an extreme bodily dismemberment and near-death ritual as procedural content, but provides no warning that this is dangerous fictional material or should not be attempted. Under the markdown-file warning criterion, harmful behaviors affecting bodily safety and integrity should be clearly disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description is entirely framed as a Chinese knowledge base and links to Chinese-language sources, but it does not state that Chinese output is optional or that the user may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest says to use the skill whenever the user mentions terms like “诡秘”, “LoM”, character names, or lore nouns such as “封印物” and “序列”. These are broad mention-based triggers rather than a narrowly scoped invocation condition, so the skill could activate on casual references instead of explicit requests for lore lookup or explanation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown provides step-by-step instructions for '魔镜占卜', including locking the room, lighting a candle, and intentionally dropping a mirror, but it does not present a clear user-facing warning not to attempt the procedure in real life. Although surrounding text mentions fictional or spiritual danger, it omits a practical safety warning about physical risk and unsafe behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

L22 明确写出“翻译成鲁恩语就是‘水果里的肉’”,体现了内容对特定语言环境的默认依赖,但未说明这是区域性设定要求,也未提供语言选择或用户 opt-in。根据规则,强制或默认特定语言/locale 且缺少说明,属于自然语言层面的政策风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description. Line L19 describes an item that can continuously affect the carrier and cause hallucinations and eventual insanity unless isolated with gold, but the document presents it as a usable material without an explicit warning section or handling caution for users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all skill content in a single forced language, Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all user-facing content in a single forced language, and there is no indication that users can opt into another language or that the Chinese-only format is required by a documented regional or compliance context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

L079 明确写明“鲁恩王国的通用语言是鲁恩语”。按本规则,语言/locale 约束若未提供用户选择、opt-in,或未说明这是特定地区/场景限定,属于自然语言层面的语言政策风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file includes step-by-step instructions for processing a corpse, removing organs and fluids, and performing rituals to create a mummy-like artifact. Under the markdown-specific warning criterion, the description omits any explicit warning that these actions are dangerous, harmful, or inappropriate in real-world contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Line L14 states that only females can exist in the described realm and that even other entrants will acquire obvious female characteristics. This is a natural-language policy issue because it forces a gendered constraint without any user opt-in or documented justification such as a clearly scoped region/compliance requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire skill file is written only in Chinese and provides no indication of language choice, localization options, or justification for being limited to a specific locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file is entirely written in Chinese and provides no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can constitute a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire skill file is written exclusively in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file describes capabilities such as inducing madness, causing loss of reason, intimidation, hypnosis-like mind reading, and covert psychological suggestion, all of which could affect a person's mental state or autonomy. The description contains no warning, limitation, or safety disclosure about potential harm, consent, or misuse despite covering behavior that could affect user safety and integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The entire skill content is written only in Chinese and does not indicate any user language choice, opt-in, or justified region-specific scope. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file presents all user-facing natural-language content in a single language and does not indicate that the language is optional or configurable. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The markdown content ends with the natural-language locale marker "en:Tinger", which appears to impose or label English localization despite the rest of the file being in Chinese. There is no user opt-in, explanation, or region-specific justification for this language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The text states '通用语言为鲁恩语', which imposes a single language expectation in natural language. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.