Security audit

业务自动化师(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This business automation skill is mostly purpose-aligned, but it grants broad execution/write capabilities while using loose triggers and some mismatched metadata, so users should review it carefully before installing.

Install this only if you intend to let an agent help design or implement business automations. Before use, remove the unrelated UI/design trigger text, require confirmation before creating cron jobs, writing files, calling APIs, sending messages, updating business systems, or touching payments/production data, and keep credentials scoped through environment variables or approved secret storage.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The metadata description is materially inconsistent with the actual skill purpose: it advertises business automation, but the description also says it should be used for UI design, poster creation, and brand visual work. This kind of capability/intent mismatch can mislead users and orchestration systems into invoking a skill in the wrong context, potentially granting exec/read/write-capable automation behavior where a low-risk creative skill was expected.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The quick-start phrase is broad enough to match ordinary user language and can cause the skill to activate in loosely related conversations. Because this skill declares powerful tools including exec and write, overbroad triggering increases the chance of unintended automation planning or command generation in contexts where the user did not explicitly intend to invoke this capability.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The listed commands are open-ended templates for designing workflows, scheduled tasks, sync schemes, and approval gates without clear guardrails on when the skill should engage. In a tool-enabled agent environment, such unconstrained prompts can widen the activation surface and encourage execution-adjacent behavior from casual user phrasing, increasing the risk of unintended task creation or unsafe automation suggestions.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill metadata and content strongly bias operation toward Chinese-language usage without an explicit user preference check. While not directly enabling code execution, this can degrade transparency and user comprehension, making it harder for some users to understand what the skill will do, review generated automation artifacts, or notice unsafe instructions before use.

Static analysis

No suspicious patterns detected.