Security audit

positive-psychology

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable emotional-support skill, but it may activate for severe crisis language without a clear emergency or self-harm safety path.

Review before installing if you expect users may express self-harm, suicidality, or immediate danger. The skill should add explicit crisis handling before use in those settings: stop ordinary coaching, encourage local emergency support or crisis lines, and suggest contacting a trusted person nearby. For low-risk Chinese-language encouragement and productivity reframing, it has no evident code, credential, persistence, or data-access behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: --- AIGC: ContentProducer: Minimax Agent AI ContentPropagator: Minimax Agent AI Label: AIGC ProduceID: 0b59f28352edc3ea89139fc5bdeabab2 PropagateID: 0b59f28352edc3ea89139fc5bdeabab2 ReservedCode1: 3046022100ce4f43dd33a2418e1fbbb8a21e2b66fea47feb05172794f33d04214243c9b93f0221009125b410961c4588e27d7d651fa00f4d1c0c46bd5c50ad23e441b00699c9aaf5 ReservedCode2: 3045022100819f79465b95a6bb991924c3b4d6c2a0bfcc76de7f2aa9bb643ecdfbe0ffb8f102202866b130a83f10069184a42883a9d63d662fe2c9027d99f5af8f139146079984 description: 正念积极心理学陪伴者 - 基于阿德勒目的论和积极心理学，提供无条件接纳与鼓励。帮助用户面对自我怀疑、逃避拖延等负面情绪，理解当下处境，转化为行动力。当用户表达焦虑、自我否定、拖延、迷茫、无助�
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill includes severe crisis language in its activation criteria and states it is not a mental-health professional, but it does not provide a clear warning or a crisis escalation path for users expressing possible self-harm or suicidality. In that context, empathetic reframing and action coaching can be actively unsafe because they may fail to assess immediacy of danger or direct the user to urgent support resources.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill is configured to trigger on severe crisis language such as '绝望' and '活不下去' while simultaneously framing itself as a general mindfulness companion rather than a crisis-support tool. This is dangerous because a vulnerable user may receive soft motivational coaching instead of immediate safety-oriented guidance, delaying escalation to emergency or professional help during an acute mental-health crisis.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list is broad enough to activate on common emotional states like stress, confusion, or fatigue, which can cause the skill to intervene in ordinary conversations where its counseling framing may be inappropriate or unwanted. Over-triggering increases the chance of misleading users into quasi-therapeutic interactions without clear consent and raises the likelihood that higher-risk statements are handled by a non-specialized companion flow.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese-language companion without any indication that users can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Static analysis

No suspicious patterns detected.