Security audit

AI需求翻译大师

Security checks for vulnerabilities and agentic risk

Overview

This skill only helps turn vague user requests into structured briefs and prompts, with no hidden execution or data-access behavior found.

Installers should understand that this skill may activate during vague planning or prompt-writing conversations, but it is designed to produce drafts and handoff suggestions only. It should not modify files, call external tools, upload content, or install/run downstream skills unless the user separately asks for that in a capable host environment.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are deliberately broad and qualitative, which can cause the skill to activate in many ordinary brainstorming or planning conversations where a more specific skill or normal assistant behavior would be more appropriate. This increases the chance of prompt hijacking of the interaction flow, unnecessary clarification loops, and accidental routing into downstream agent workflows based on weak signals.

Static analysis

No suspicious patterns detected.