Security audit

Create Business Plan

Security checks for vulnerabilities and agentic risk

Overview

This business-plan skill has a coherent purpose, but it asks agents to persistently edit the skill itself and read project memory/logs, which users should review before installing.

Install only if you are comfortable with a business-plan assistant that may edit its own skill instructions, read project memory/logs during update requests, and use external document-upload tooling. Safer use would require disabling automatic SKILL.md edits, confirming exact memory files before reading them, pinning dependencies, and requiring explicit approval before cloud uploads or knowledge-base storage.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:215
Finding: Persistent Skill Self-Modification from User-Controlled Feedback
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:217
Finding: Overbroad Collection of Persistent Agent Memory and Session History
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:204
Finding: Unpinned Installation of the Pillow Dependency
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:109
Finding: Execution of Unbundled Scripts from an External Skill
Content: View full analysis
--title ` produces an `.aipage` file. The script is located in the tencent-docs Skill directory. 2. `python import_file.py <aipage>` from the same Skill directory performs `pre_import` and uploads the file to COS. 3. Call `manage.async_import` and poll `manage.import_progress` until completion. ``` ### Technical Analysis The audited package contains only `SKILL.md` and `manifest.yaml`; it does not contain `aipage_pack.js` or `import_file.py`. The Skill nevertheless directs the agent to locate and execute those scripts from a separate `tencent-docs` Skill. Because the external scripts are not version-pinned or integrity-checked here, their behavior cannot be established by auditing this package. The effective implementation can change independently after this Skill has been reviewed. The second script is also described as uploading the generated document to COS, causing business-plan content to cross a local-to-cloud trust boundary. This is not confirmed remote payload retrieval because the instructions do not explicitly download code from a URL. It is an insecure dependency on unbundled local components whose provenance and implementation are outside the reviewed artifact. ### Attack Path 1. A user requests an online-editable business-plan deliverable. 2. The agent locates `aipage_pack.js` and `import_file.py` in another installed Skill. 3. The ...[truncated 1018 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auto-load trigger is broad enough to activate on ordinary business-plan-related discussion, causing the skill to run even when the user did not explicitly request it. Unintended invocation increases the chance of unnecessary file access, persistence behavior, or workflow actions being applied outside the intended scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill requires the agent to edit its own SKILL.md after routine task completion, creating a self-modifying instruction set without strong approval boundaries. This can let untrusted task output or user feedback persist into future runs, causing prompt drift, policy bypass, or propagation of unsafe behavior across sessions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
2. 依据反馈，用 **Edit** 直接更新本 `SKILL.md`：

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The intake section states the target market defaults to North America, which bakes in a locale/region assumption into the workflow. Because this default is not framed as an opt-in choice or justified as a region-specific compliance tool, it can violate the policy against forcing a locale without user selection.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill recommends storing reusable assets and project knowledge in knowledge bases or local files, which can retain user-provided content beyond the immediate task and make it accessible later in unintended contexts. Even if intended for convenience, persistent storage of BP materials can include sensitive business strategy, financial assumptions, or competitive analysis.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Reading project memory and daily logs across sessions can expose historical user-provided data that is unrelated to the current request. In the context of a BP-authoring skill, this is more dangerous because the workflow does not inherently require broad retrospective access, so the extra data collection is disproportionate and creates avoidable privacy risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to read .workbuddy/memory/ including MEMORY.md and daily logs across sessions, which exceeds the narrow needs of drafting a business plan and can expose unrelated prior user data. Cross-session memory access expands the data surface and may leak sensitive information from earlier projects into the current task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill tells the agent to modify SKILL.md after each task without a prominent user-facing warning that the skill file itself will be altered. Hidden modification of system behavior is dangerous because it changes future execution state and may preserve unsafe or task-specific instructions beyond the user's awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file claims the public release removed private paths and credential paths, but the body still references local memory paths and credentialed integrations. This mismatch can mislead reviewers and operators into underestimating privacy and secret-handling risks, increasing the chance of unsafe deployment or trust in inaccurate documentation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "BP" is highly ambiguous and can match many unrelated user intents, causing the skill to activate outside its intended business-planning context. Over-broad activation can route users into the wrong workflow, create prompt/skill hijacking opportunities, and increase the chance of inappropriate data collection or unintended task execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger "business plan" is broad and overlaps with common, generic requests, so the skill may be invoked for many contexts beyond this specialized methodology. This increases accidental activation risk and can expose users to irrelevant or unintended behavior when they were not asking for this specific skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest includes Chinese-only description content and several Chinese trigger phrases, but does not state whether language choice is user-selectable or optional. This may create an implicit language/locale preference without explicit opt-in, which can conflict with language-choice policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.