hr-admin-assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Chinese HR/admin document assistant, but it includes under-controlled persistent self-modification and an unrestricted file overwrite path that merit review before installation.

Review this skill before installing in a shared or persistent agent environment. Remove or require maintainer approval for the instruction that modifies SKILL.md trigger terms, and constrain generated document output to a safe directory with no overwrite by default. The HR/legal templates should also be treated as drafting aids, not final legal advice.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:156
• Finding: Persistent Self-Modification of Skill Activation Rules## Vulnerability Details **File Location**: `SKILL.md`, line 156 **Vulnerability Type**: Persistent modification of agent behavior **Risk Level**: Medium **Vulnerable Code**: ```markdown 每次使用后，如发现业务场景未被覆盖，应将新的触发词追加到 SKILL.md 的 description 触发词列表中。 ``` English translation: “After each use, if an uncovered business scenario is found, append the new trigger terms to the trigger-term list in the `description` field of `SKILL.md`.” ### Technical Analysis This instruction directs the Agent to modify the installed Skill after use by appending newly observed trigger terms to persistent Skill metadata. These modifications can survive the current session and change when the Skill is activated in future sessions. The update mechanism lacks user approval, provenance tracking, validation, deduplication, scope restrictions, and a trusted review process. Because the proposed trigger terms can originate from user-controlled requests, an untrusted user may indirectly influence the Skill's persistent activation rules. ### Attack Path 1. An attacker submits a request containing an unusual or overly broad phrase. 2. The Agent determines that the business scenario is not represented by the current trigger list. 3. Following line 156, the Agent appends the attacker-influenced phrase to `SKILL.md`. 4. The modified trigger remains available across future sessions. 5. Subsequent requests containing that phrase may activate the Skill in unrelated or unintended contexts. ### Impact Assessment Successful exploitation can persistently broaden the Skill's activation scope and affect future Agent behavior. It does not directly grant operating-system privileges, execute code, or expose credentials. Its scope is limited to persistent Skill configuration and future Skill-selection behavior, but repeated poisoning could cause inappropriate activation, degraded task routing, and durable behavioral influence.
• Remediation: ## Remediation Suggestions - Remove the instruction requiring automatic modification of `SKILL.md`. - Present newly proposed trigger terms to the user or Skill maintainer as non-persistent recommendations. - Require explicit, trusted approval before changing activation metadata. - Validate approved triggers against length, syntax, scope, and duplication constraints. - Reject control instructions, broad generic phrases, and content derived directly from untrusted input. - Apply changes through version control so modifications are attributable, reviewable, and reversible. - Keep the installed Skill read-only during ordinary execution where practical.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_doc.py:285
• Finding: Unrestricted Overwrite Through User-Controlled Output Path## Vulnerability Details **File Location**: `scripts/generate_doc.py`, lines 285–287 **Vulnerability Type**: Arbitrary writable-file overwrite **Risk Level**: Medium **Vulnerable Code**: ```python if output_file: with open(output_file, "w", encoding="utf-8") as f: f.write(doc_content) ``` ### Technical Analysis The document generator accepts the `output_file` value from the command-line `--output` argument and passes it directly to `open()` in truncating write mode. It does not constrain output to a dedicated directory, normalize and validate the path, reject traversal, detect symbolic links, or prevent replacement of an existing file. Opening a path with mode `"w"` truncates an existing file before writing. Therefore, an attacker who can influence the argument used by an Agent or automation can replace any file writable by the process. The generated content is template-based rather than arbitrary binary content, but destructive truncation remains possible. ### Attack Path 1. An attacker requests HR document generation and supplies a sensitive writable path as the desired output filename. 2. The Agent or surrounding automation passes that path through `--output`. 3. `generate_document()` receives the path without validation. 4. `open(output_file, "w", ...)` follows the path and truncates the target. 5. The target is replaced with generated Markdown content, potentially corrupting configuration, project data, Skill instructions, or user files. A similar result may be achieved through a symbolic link placed at an allowed-looking output path if the executing environment permits the attacker to create that link. ### Impact Assessment Exploitation permits destructive modification of files writable by the process. It does not bypass operating-system permissions or grant privileges beyond the executing account. Depending on that account's permissions, affected files may include project files, application co ...[truncated 209 chars]
• Remediation: ## Remediation Suggestions - Restrict generated files to a dedicated output directory controlled by the application. - Resolve the requested path with `pathlib.Path.resolve()` and verify that it remains beneath the approved output directory. - Reject absolute paths, parent-directory traversal, device paths, and symbolic-link targets. - Refuse to overwrite existing files by default; use exclusive creation mode (`"x"`). - If replacement is required, expose a separate trusted `--force` option and require explicit confirmation. - Create files with restrictive permissions appropriate for potentially sensitive HR content. - Use a temporary file in the destination directory followed by an atomic rename after validation. - Log the resolved destination and overwrite decision for auditability without logging sensitive document contents.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes very broad phrases such as '帮我写', '写一个', and '做一个方案', which are common across many unrelated tasks. This can cause the skill to activate outside intended HR/admin contexts, potentially steering general user requests into an over-privileged or context-inappropriate workflow that reads internal references or produces sensitive policy/legal content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The skill description is written as a Chinese-only assistant persona and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicit and justified.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation criteria cover a very wide range of back-office requests without strong boundaries or opt-out conditions. In a multi-skill environment, this increases the chance of unintended routing of sensitive or unrelated requests, which may lead to inappropriate generation of HR, legal, or policy guidance without sufficient user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The natural-language content in this reference file is entirely in Chinese, and there is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The title and instruction text require AI-generated documents to follow this Chinese-language template structure, but the file does not indicate that language selection is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring, usage instructions, and behavior description are entirely in Chinese, which effectively forces a specific language for users and downstream AI consumption. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified; neither is present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains natural-language instructions, descriptions, and output messages exclusively in Chinese, including the module docstring and CLI help text. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is explicitly justified, which is not present here.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file's natural-language content is entirely in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy, a fixed language without user opt-in or clear justification is a locale/language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file is entirely authored in Chinese from the title onward, with no indication that users may choose another language or that the skill is restricted to Chinese-speaking or PRC-specific workflows. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The entire template file is written in Chinese and presents reporting guidance exclusively in that language, with no indication that language choice is optional or that the skill is intended only for a Chinese-speaking context. Under the stated policy, a fixed language without opt-in or justification can be a natural-language locale violation.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This file's user-facing natural language in the docstring and printed messages is exclusively Chinese. Under the stated policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Static analysis

No suspicious patterns detected.