Security audit

早餐推荐助手

Security checks for vulnerabilities and agentic risk

Overview

This breakfast helper stores and updates only its own food-preference files and can create a user-requested breakfast reminder, with no hidden code, exfiltration, or unrelated access found.

Install this if you want a Chinese-language breakfast assistant that keeps a small local fridge list, preference file, and recommendation history. Be careful when giving a full new fridge list because it can replace the prior fridge.md contents, and only create recurring reminders if you are comfortable with a scheduled agent turn continuing until cancelled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: 整个技能说明和输出格式均固定为中文，未说明是否支持其他语言，也未提供用户选择语言的机制。若组织要求尊重用户语言偏好，这种默认且未声明的单一语言约束可能构成自然语言策略违规。

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: 该技能明确要求在首次使用时自动创建目录，并在更新食材场景下对 fridge.md 进行“完整覆盖”。虽然写入路径限定在技能工作目录内，但缺少显式确认、覆盖风险提示和备份机制，可能导致用户已有数据被无意清空或替换，属于持久化数据完整性风险。

Vague Triggers

Medium

Confidence: 90% confidence
Finding: L029-L031 将“买了xxx”“查看食材”等日常短语直接作为触发示例，缺少更明确的上下文约束，容易与普通对话重叠。虽然文件说明了早餐/冰箱领域，但这些短语本身仍较通用，且未提供明确的排除条件或负例。

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: 技能会创建 cron 定时任务并设置自动执行的 agentTurn，但没有要求向用户清楚说明这是持续性自动行为、会在未来反复触发，也未强调取消方式和权限边界。持久化自动执行机制本身会扩大误用面，一旦用户误解或误触发，就可能造成持续骚扰、意外通知或长期运行超出用户预期。

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The entire file is written in Chinese with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.