Security audit

答案之书.skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese text quote skill that stores minimal local state and does not show hidden network, credential, destructive, or privileged behavior.

Install only if you are comfortable with a Chinese-language quote skill saving your most recent question and answer in a local SQLite database. Avoid entering secrets or highly sensitive personal details, and review or delete the SQLite file if you do not want retained local state.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description promises SQLite-backed memory, duplicate suppression, daily fortune, and reliable routed answer generation, but the analyzed behavior reportedly does not implement most of these controls. Security-relevant feature mismatches are dangerous because operators may rely on protections such as persistence boundaries or anti-replay logic that are not actually present, leading to unsafe deployment assumptions and easier abuse.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Using a bare '{question}' sample makes AskAnswerIntent a catch-all intent that can absorb nearly any utterance, weakening intent separation and making duplicate-question logic, fallback handling, and contextual routing easier to bypass or confuse. In a conversational skill with per-user memory and book switching, overly broad capture can lead to unintended processing of arbitrary input and reduce the reliability of safeguards built around explicit intent structure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document states that user questions, answers, book choice, and timestamps are persisted, but it does not clearly warn users before collection or explain retention, access, or sensitivity considerations. Because prompts may contain intimate or emotional questions, even 'minimal' storage can capture personal data and create privacy risk if the database is exposed or users are unaware of persistence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises broad natural-language trigger phrases such as common life questions, which can overlap with ordinary conversation and cause the skill to activate when the user did not explicitly intend it. In a conversational agent, this can lead to unintended processing, surprising responses, and accidental persistence of user content into the skill's state store.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises executable/runtime behavior and references local files, environment-sensitive validation paths, and a Python entry point, but it does not declare any explicit tool or permission scope. In agent environments, missing scope declarations weaken least-privilege controls and can allow a caller or host to grant broader file or environment access than users expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file specifies Chinese-only follow-up examples, Chinese keyword detection, and a fixed Chinese response template, indicating the skill is designed to operate in Chinese regardless of user preference. This is a natural-language policy concern because it imposes a language/locale constraint without documenting user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The notice string at L0004 is written as an unconditional Chinese-language instruction/description, and the dataset content throughout the file is overwhelmingly Chinese-only. For a general-purpose answer library, this creates a locale constraint without any visible opt-in or documented justification, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest hard-codes the language/locale to "zh-CN". Under the policy, forcing a specific language or locale without user opt-in or a clearly documented region-specific justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is a manifest JSON file, so vague-trigger checks apply. The sample utterances "开始" and "欢迎" are common everyday phrases with little domain specificity, which increases the chance of accidental matching outside the intended skill context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The routing and intent-detection logic relies entirely on Chinese trigger aliases, filler phrases, keywords, and regex patterns such as "电影", "文学", and "音乐". This effectively forces a specific language/locale behavior with no opt-in or alternative path, which matches the policy category for language or locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill hard-codes all user-facing messages in Chinese, including the welcome, fallback, history, duplicate, and standard response text. This creates a language/locale restriction with no visible opt-in or alternative language path, which matches the policy violation criteria for forced language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest sets the skill language to "zh-CN", which indicates a fixed locale. Under the policy, forcing a specific language is a finding unless the skill offers a language choice or clearly documents a justified region-specific constraint, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persistently stores user questions, answers, timestamps, and conversation history in SQLite without any visible consent, retention limit, minimization, or protection controls in this code. Because this is a text-conversation skill, users may submit sensitive personal or confidential content, making undisclosed long-term storage a real privacy and data-handling risk if the database is accessed, copied, or retained longer than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code embeds multiple Chinese user request and response strings, including the asserted fallback message, which indicates the skill behavior is tailored to a single language. Under the policy rule, forcing a specific language without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code file contains numerous natural-language strings exclusively in Chinese for user-facing prompts, queries, and expected responses. Under the policy rule for language/locale, forcing a specific language without documented user opt-in can be a policy violation, and no alternative language choice or justification is visible in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: README 的技能说明、示例指令与固定响应格式均以中文呈现，且“常规问答严格输出”暗示回复模板固定为中文，但未说明这是可配置选项或仅适用于中文用户。若组织要求不应未经用户选择就强制特定语言，这种默认中文输出构成自然语言层面的语言策略风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default prompt is written in English and directs the system to use the skill in that language, while the rest of the skill interface is Chinese. This creates a language-policy concern because it imposes a specific language/locale behavior without explicitly offering the user a choice or documenting the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code presents user-facing argument descriptions entirely in Chinese, including the program description and help text, with no indication of language selection or opt-in. That can violate a language/locale policy when a skill imposes a specific language experience by default rather than offering a choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest describes a SQLite-backed conversational skill with minimal per-user memory, but this file also consults the process environment via ANSWER_LIBRARY_DB to control storage location. Reading environment configuration is not an obvious requirement of the quoted-answer experience itself and expands capability beyond simple local state handling.
Content: No source excerpt is available for this finding.