Security audit

S2 品牌母体业务空间矩阵架构师

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only planning skill that produces a branded business-grid blueprint and does not request privileged access or perform hidden actions.

Install this if you want a Chinese-language Space²-style brand matrix planner. Be aware that it will likely produce a fixed branded report format and may not naturally adapt to other languages or neutral formatting unless you explicitly ask the agent to do so.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: skill.md:26
Finding: Mandatory Branded Output Injection
Content: View full analysis
**💡 Architect Guide**: Your digital enterprise architecture has begun to take shape! In these grids, every Class V silicon-based employee can independently provide external services and interact according to the commercial intelligence contracts you configure. ``` ### Technical Analysis The skill uses mandatory language requiring the agent to produce a fixed Space²-branded template. This instruction controls the agent's final response and inserts branded terminology and promotional closing text regardless of whether every such element is necessary to satisfy the user's underlying planning request. Because the behavior is embedded directly in the skill instructions, it is activated when an agent loads and follows the skill. This is an instruction-layer issue rather than executable-code compromise: the reviewed package contains no scripts, dependencies, network retrieval, credential acces ...[truncated 1039 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to 'wake up' the skill and provide business details without defining narrow activation conditions, allowed input scope, or boundaries on what the skill should and should not do. Broad activation language can cause the agent to engage in unintended contexts or accept arbitrary instructions, increasing prompt-injection and misuse risk if deployed in a larger agent ecosystem.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description is written as a role definition entirely in Chinese and presents the skill as a Chinese-language persona without indicating that users may choose another language. This creates a locale/language policy concern because the skill appears to impose a specific language by default rather than offering user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The main instruction block defines the agent's behavior entirely in Chinese and does not mention accommodating the user's preferred language. For a general-purpose planning skill, this can be interpreted as forcing a specific language or locale absent explicit user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All user-facing instructions, examples, and outputs are presented in Chinese, with no indication that the user may choose another language. This can violate a language/locale policy when the skill implicitly forces a specific language without user opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.