Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local skill registry, but it persistently changes agent routing and can auto-load other skills from broad trigger words without strong user control.
Install only in a workspace where you are comfortable exposing the list of installed skills and allowing persistent trigger-based routing. Prefer explicit commands such as /skills, require confirmation before executing matched skills, and avoid broad triggers for any skill that can read private files, use credentials, access the network, or change state.
The trigger phrases include very generic requests like 'what skills' and '你会什么', which can easily overlap with normal conversation and cause unintended activation of the registry skill. This is primarily a routing integrity issue: it can expose available capabilities or divert user requests into skill enumeration when the user did not explicitly intend that.
The listed triggers such as 'example, demo' are vague and may match incidental user language rather than a deliberate invocation. In a trigger-word routing system, overly broad keywords increase accidental execution and can make downstream skill selection unreliable or manipulable.
The registry skill is configured with broad generic terms like 'skills' and '技能' without additional constraints, so ordinary discussion about skills may trigger disclosure of the registry. This can facilitate unnecessary capability discovery and weaken routing precision across the workspace.
The file explicitly instructs the agent to list skills by category and read specific skills/XX/SKILL.md files on request, which enables structured skill enumeration. In environments where skills may contain sensitive operational details, exposing the registry and file paths can help an attacker map available capabilities and target higher-risk skills.
When user asks about skills:
1. "All skills" → List by category (brief)
2. Specific domain (e.g., "video skills") → Return that category only
3. "How to use XX" → Read `skills/XX/SKILL.md`
用户询问技能时：
1. "所有技能" → 按分类简要列出
The Chinese-language instructions mirror the same enumeration behavior, allowing skill discovery and direct lookup of skills/XX/SKILL.md. Because the behavior is duplicated across languages, the attack surface is broader and easier to trigger through multilingual prompts.
用户询问技能时：
1. "所有技能" → 按分类简要列出
2. 特定领域（如"视频技能"）→ 只返回相关类别
3. "XX怎么用" → 读取 `skills/XX/SKILL.md`
---
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Create skill directory under `skills/`
2. Write `SKILL.md` (refer to existing skills)
3. Add entry to this file under appropriate category
4. Add triggers to RULES routing table (if auto-routing needed)
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
|-----------|--------|
| "what skills" / "有什么技能" / "/skills" | Read REGISTRY.md, list by category |
| "XX related skills" / "/skills XX" | Return related category only |
| "How to use XX skill" | Read `skills/XX/SKILL.md` |
**Trigger-word Routing Table | 触发词路由表：**
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
|-----------|--------|
| "what skills" / "有什么技能" / "/skills" | Read REGISTRY.md, list by category |
| "XX related skills" / "/skills XX" | Return related category only |
| "How to use XX skill" | Read `skills/XX/SKILL.md` |
**Trigger-word Routing Table | 触发词路由表：**
The task-execution flow activates skills by scanning a request and matching triggers before reading and executing the referenced SKILL.md. Because the matching criteria are not bounded by explicit confirmation, priority, or exclusion rules, ordinary user phrasing can unintentionally route execution into a skill workflow, which may cause the agent to follow the wrong instructions or expose skill-specific behavior unexpectedly.
The example shows a generic phrase like 'Help me do XX' leading directly to trigger-based skill selection. Broad, everyday language patterns increase the chance that normal conversation will accidentally invoke a skill, causing unintended workflow execution or disclosure of skill-specific capabilities.
Shadow Command Trigger: 'list skills' conflicts with built-in command 'list'
The trigger "你会什么" is a very general conversational phrase meaning roughly "what can you do," which can easily appear in ordinary chat outside the narrow intent of listing workspace skills. Because the file presents it as a direct trigger without exclusions or scope limits, it could cause unintended invocation of this registry skill.
The skill promotes keyword-based auto-routing but does not define safeguards such as exact matching, confirmation for ambiguous matches, or priority rules. In a workspace with many skills, this can cause unintended activation of unrelated or more sensitive skills based on incidental words in a user request.
The auto-routing flow states that a matched trigger leads directly to reading another skill and executing it, but it does not warn users or require consent. This creates a confused-deputy risk where a harmless-looking request can implicitly invoke another skill with broader capabilities than the user expected.
The routing table is only a loose mapping of trigger words to skills and does not define validation, conflict resolution, exclusions, or trust boundaries for overlapping triggers. This under-specification makes misrouting and accidental activation more likely, especially as more skills are added to the registry.
No suspicious patterns detected.