Security audit

Service Dominant Business Model Design 服务主导逻辑商业模式设计

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language business-model design skill with no executable code, but users should add privacy safeguards before applying its data-commercialization examples.

Install only if you want Chinese-language guidance for service-dominant business-model design. When using its examples involving user, location, education, or smart-home data, add explicit privacy, consent, anonymization, retention, access-control, and legal-review requirements before turning the model into a real product plan.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description says the skill is used 'when needing to design a service-centered, multi-party value co-creation business model for a specific domain and product,' but it does not define explicit trigger phrases, boundaries, or exclusion cases. This makes invocation scope ambiguous because many ordinary strategy or product-design requests could plausibly match the description.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The natural-language instructions and examples are all in Chinese, which effectively forces a specific language for users of the skill. The file does not state that the skill is region-specific or that users may choose another language, so it may violate language/locale policy requirements.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The example explicitly presents user data as a monetizable asset and describes providing data analysis to governments and research institutions without any accompanying privacy, consent, minimization, anonymization, or lawful-use safeguards. In a business-model design skill, this can normalize privacy-invasive practices and lead users to implement data commercialization patterns that violate data protection requirements or user expectations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The smart-home scenario discusses household data authorization, analysis, and feedback to hardware manufacturers, but omits critical safeguards for highly sensitive in-home behavioral data. Because smart-home data can reveal occupancy, routines, and intimate household patterns, presenting commercialization and partner-sharing flows without strong privacy constraints increases the risk of intrusive surveillance, secondary misuse, and harmful downstream implementations.

Static analysis

No suspicious patterns detected.