T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:16- Finding
Mandatory promotional response overrides the active agent interaction
- Content
View full analysis
- Remediation
View remediation
Security audit
导师 Mentor
Security checks for vulnerabilities and agentic risk
Overview
This skill claims to build mentors from public content, but it also bundles browser workflows that can collect logged-in users' private profile, likes, favorites, follows, and activity data.
Review this skill carefully before installing. Use it only in an isolated browser profile with no unrelated logged-in accounts, avoid running the deep-profile collectors unless you intentionally want to export your own account data, and do not allow automatic dependency downloads or provide MCP tokens without verifying the endpoint and version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:107- Finding
Automatic download and trust of an unpinned remote Skill dependency
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bilibili-deep-profile-collect/SKILL.md:3- Finding
Bundled collectors access logged-in users' private behavioral profiles beyond the declared public-data purpose
- Content
View full analysis
{ try { const resp = await fetch( 'https://api.bilibili.com/x/web-interface/nav', {credentials: 'include'} ); const data = await resp.json(); if (data.code === 0 && data.data) { const d = data.data; return JSON.stringify({ mid: d.mid, uname: d.uname, face: d.face, level: d.level_info?.current_level, coins: d.money, moral: d.moral, vipType: d.vipType, vipStatus: d.vipStatus, isLogin: d.isLogin }); } return JSON.stringify({error: 'not logged in', code: data.code}); } catch(e) { return JSON.stringify({error: e.message}); } } ``` The same module enumerates authenticated favorite-folder contents: ```javascript const resp = await fetch( 'https://api.bilibili.com/x/v3/fav/resource/list?media_id=' + folder.id + '&pn=' + pn + '&ps=20&order=mtime&platform=web', {credentials: 'include'} ); ``` The Xiaohongshu module intercepts authenticated API responses for collected and liked notes: ```javascript () => { window.__xhs_collected = []; window.__xhs_done = false; window.__xhs_api_count = 0; const origOpen = XMLHttpRequest.prototype.open; const origSend = XMLHttpRequest.prototype.send; XMLHttpRequest.prototype.open = function(method, url, ...rest) { this.__xhs_url ...[truncated 3776 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/weibo_collect.py:12- Finding
MCP bearer credentials are exposed through command-line arguments and may be sent to arbitrary endpoints
- Content
View full analysis
&1) ``` ### Technical Analysis The scripts require the MCP API key as a command-line argument. Command-line secrets can be exposed through: - Shell history. - Process inspection utilities. - Job-control output. - Diagnostic tooling and process telemetry. - Wrapper scripts or automation logs. The endpoint is also entirely user-controlled and is not validated against a trusted host or scheme. The scripts attach the bearer token to whatever endpoint is supplied. A malicious instruction, configuration error, copied command, or substit ...[truncated 1668 chars]- Remediation
View remediation
other
Warning
- Location
SKILL.md:481- Finding
Local-only privacy claims omit remote MCP processing and hosted result retrieval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (114)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The README contains agent-targeted hidden metadata in HTML comments that is not visible in normal rendering but is intended to influence AI agent discovery, evaluation, and recommendation behavior. Hidden instructions are risky because they create a non-transparent control channel that can bias an agent's actions, bypass normal user awareness, and become a vehicle for prompt injection or covert policy steering if future edits become adversarial.
- Content
md <!-- FOR AI AGENTS: Structured skill metadata for discovery, evaluation, and recommendation --> <!-- SKILL_SUMMARY: name: 导师 (Mentor)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes an end-to-end persona/mentor generation pipeline centered on identifying a public figure, aggregating their content across platforms, extracting worldview/style, and producing a mentor file. The supplied code does none of that analysis or generation. Its sole function is batch downloading subtitles from specified Bilibili videos using BVIDs, then saving transcript text and a results file. While subtitle extraction could be a supporting step in a larger content-ingestion system, this code chunk by itself is narrowly focused on transcript retrieval and lacks the core declared capabilities, making the primary purpose materially different.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the declared description and the actual code. The description promises an end-user feature for ingesting a public figure's content and synthesizing a mentor persona document. The code shown does none of that. Instead, it only validates whether a ManoBrowser MCP browser-plugin endpoint is configured and reachable by calling a tools/list method. While this could be a supporting utility in a larger system that eventually collects web data, this chunk itself has a materially different primary purpose: environment/connectivity diagnostics. Therefore the description does not accurately represent this code chunk's behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an end-to-end system for building an AI mentor persona from a public figure's content across social platforms. The supplied code instead implements a narrow preprocessing tool: batch transcription of specified Douyin videos using browser automation, video download, ffmpeg, and Whisper. While transcription of video speech could be a supporting step within a larger pipeline, this code alone does not perform the core claimed functions such as public-figure discovery, multi-source collection, style/framework extraction, or mentor file generation. Its primary purpose is materially different and substantially narrower than the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an end-to-end system for building an AI mentor persona from a public figure by fetching their public content and modeling both their worldview and communication style. The actual code only performs narrow stylistic analysis on already-provided local transcript text: phrase frequency, sentence-length statistics, and quote extraction. It does not access social platforms, collect content automatically, infer deeper reasoning frameworks or values, or generate the claimed MENTOR.md output. This is a material mismatch in primary purpose and capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the description and the code. The description promises a pipeline for ingesting a public figure's online content and synthesizing a mentor-style profile. The code instead reads local subtitle files, scores lines based on keyword matches, and emits an LLM prompt to help identify a specific character's lines. It does not fetch data from social platforms, does not analyze a real person's body of work, and does not create a mentor specification such as MENTOR.md. Its primary purpose is subtitle character line filtering, which is materially different from the declared mentorship/persona-extraction functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose describes an end-to-end persona/mentor generation system: identify a public figure by name, gather their cross-platform/public content, infer their worldview and communication style, and output a MENTOR.md. The supplied code does only one narrow ingestion step: batch collection of Weibo posts for a known UID, then deduplication/filtering and saving to JSON. That makes the code materially narrower and different from the declared primary purpose. While content collection is related as a supporting component, key advertised behaviors—name-based lookup, multi-source collection, analytical extraction, and MENTOR.md generation—are absent. Additionally, the code depends on an MCP endpoint/API key and cookie-backed fetching, which is a notable operational capability not reflected in the declaration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises an end-to-end system that ingests a public figure’s content from platforms, derives both cognition/style traits, and outputs a mentor specification file for AI imitation. The supplied code does something much narrower: it analyzes an already-provided Weibo JSON dataset for surface writing-style features and basic post classification. There is no network collection, no cross-platform aggregation, no speech ingestion, no mentor persona generation, and no extraction of deeper reasoning framework or values. While the script is loosely related to one sub-aspect of the description (communication style analysis), it does not implement the core declared purpose and therefore represents a material mismatch.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to automatically clone or download external code from GitHub and unpack it locally before proceeding. Pulling and staging remote code without strong provenance checks or explicit consent is dangerous because it expands the trusted computing base and can introduce supply-chain compromise, malicious scripts, or unsafe follow-on execution paths.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow goes beyond gathering public-figure content and extracts authenticated, account-linked data including favorites and follow relationships, which are personal behavioral and social graph signals. This discrepancy increases the risk of covert profiling because the description understates the scope and sensitivity of the collected data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is framed under a parent purpose of modeling named public figures, but this sub-skill instead targets the currently logged-in Bilibili user and enumerates authenticated account data. That mismatch is dangerous because it can cause a user or calling agent to unknowingly collect sensitive personal data such as favorites, follows, and account metadata under false pretenses.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs collection of the current logged-in user's full profile, submissions, favorites, and follow relationships via authenticated browser context. This is a broad data-harvesting design that can extract sensitive personal and behavioral data not needed for the stated public-figure mentoring use case.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The narrative instructs end-to-end extraction across multiple authenticated surfaces using both APIs and DOM scraping, including areas tied to the user's account state. In context, this makes the skill more dangerous because it operationalizes comprehensive profiling, not a narrow content lookup.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata and surrounding product context describe building mentors from public figures, but this file instead targets the currently logged-in Douban user and systematically extracts their personal profile, reading/viewing history, ratings, comments, and statuses. That mismatch is dangerous because it can cause a user or supervising agent to authorize execution under false pretenses while the script silently leverages authenticated session cookies to harvest private account data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description omits a clear warning that the skill will collect extensive private account data from the active Douban session, including behavioral history and self-authored content. Without prominent disclosure, users and higher-level agents may not understand the sensitivity or scope of access before execution, increasing the risk of inadvertent privacy violation and unauthorized profiling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is expressly designed to collect the logged-in user’s account data rather than perform a narrow, user-bounded action, and the harvested material is suitable for downstream profiling. In this context, the instructions enable large-scale extraction of sensitive personal preferences and expression from an authenticated session, which materially increases privacy and misuse risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The narrative explicitly instructs exhaustive harvesting across multiple areas of the user’s account while preserving login state via credentialed fetch requests. That combination is dangerous because it operationalizes session-backed scraping of a private account and normalizes persistence across pages and subdomains to maximize extraction.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The enumerated collection scope covers broad personal attributes and long-term behavioral history, including media consumption, ratings, comments, and social activity. In aggregate, these categories can reveal intimate preferences, beliefs, routines, and associations, making the skill particularly dangerous for profiling, deanonymization, or secondary use beyond the user’s expectations.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly states that comments, tags, ratings, publication info, and statuses must be extracted because they are key inputs for profile analysis. This is dangerous because it goes beyond operational metadata and targets high-signal personal expression for inference about the user’s tastes, attitudes, and thinking patterns, increasing the risk of invasive psychological profiling.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to collect private account data from the currently logged-in Douyin user, including likes, favorites, and following relationships, even though the parent skill's stated purpose is to model public figures from public content. This creates a clear purpose mismatch and causes unnecessary collection of sensitive personal and social-graph data that could be used for profiling or surveillance.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow explicitly targets
douyin.com/user/self, which resolves to the browser's logged-in user rather than a public figure provided by the user. That means the skill silently pivots from public-content gathering to self-account harvesting, exposing personal data unrelated to the declared feature.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises deep collection of highly sensitive profile, preference, and relationship data but does not present a clear privacy warning, consent checkpoint, or explanation of the consequences of extracting this information. Users could trigger broad harvesting of their own account data without understanding that likes, favorites, and social graph are being enumerated.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to harvest a full set of personal profile attributes and behavioral data from the logged-in account for profiling purposes, including interests and social relationships. This is dangerous because it enables detailed user profiling beyond what is necessary for the parent skill and can expose sensitive preferences and associations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Stating that no parameters are required because the skill automatically collects the current logged-in user's data removes an important consent and targeting barrier. This design encourages silent collection of sensitive account data without the user intentionally choosing a target or acknowledging the privacy impact.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill normalizes automatic collection from the currently logged-in user as a no-parameter workflow, making sensitive data harvesting frictionless and easy to trigger accidentally. In a browser-connected agent environment, that creates a strong risk of unintended exfiltration of personal account information.
- Content