Back to skill

Security audit

行业诊断 (Industry Diagnosis)

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language industry analysis skill for China-market sector diagnosis, with no executable code, persistence, credential handling, or hidden system access.

Install this if you want Chinese-language China-market industry diagnosis using finance and web data. Be aware that it produces investment-style sector ratings and allocation suggestions, so users should verify data sources and avoid treating outputs as personalized financial advice; non-Chinese users may also find the fixed Chinese template limiting.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill metadata and required output template are entirely in Chinese and prescribe a fixed language/format without indicating that the user’s preferred language should be honored. This can override user intent, reduce usability for non-Chinese speakers, and create prompt-priority conflicts where the skill steers responses away from the user’s requested language or format.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document title and the entire skill content are written in Chinese, with no indication that users may request another language or that the skill is intentionally limited to a Chinese-language or China-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This file presents all user-facing instructional content in Chinese only, and there is no indication that the skill is region-specific or that users may opt into this language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill is written as mandatory Chinese-language guidance and does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, a skill that effectively enforces a specific language without opt-in should be flagged unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file consists exclusively of Chinese-language headings and guidance, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing methodology content exclusively in Chinese, and nowhere indicates that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document title and all instructional content in this skill file are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.