提示词架构师专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

This is a prompt-engineering helper, but it requests broad file and shell authority with loose activation scope and under-described callback/execution behavior.

Review before installing. Use it only for intended prompt-engineering workflows, keep callbacks and external integrations disabled unless you explicitly need them, and require confirmation before any command execution, file write, credential storage, or network-facing action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The declared capability coverage lists extremely broad Chinese keywords and phrases that can match common workplace, engineering, and conversational language. In a tool-enabled agent runtime, such broad matching materially raises the risk of unintended skill activation, and because the skill has read, write, grep, glob, and exec, accidental selection could result in sensitive data access or unintended actions far outside prompt-engineering assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broad and tied to generic prompt-architect and development scenarios, which increases the chance that an agent platform will auto-select or invoke it for ordinary conversations beyond the author’s intended scope. Overbroad triggering is dangerous because this skill also declares powerful tools, so accidental activation could expose files, perform writes, or lead to command execution in contexts where the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares exec for what is primarily a prompt-engineering/documentation workflow, while the markdown only loosely references optional validation and test scripts. In an agent ecosystem, granting shell execution unnecessarily expands the attack surface: prompt content, examples, or future modifications could induce command execution, file access, or network side effects unrelated to the skill’s core purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown introduces callback_url and multiple execution-capable tools without a prominent warning that user data, model outputs, or tool results may be transmitted externally or cause side effects. In practice, users may provide sensitive prompts or internal documents, and without explicit notice and consent boundaries, the skill can facilitate silent exfiltration or unintended actions through callbacks and tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file explicitly states it was '完全重写为中文专业版', and the skill name, description, and most operating instructions are in Chinese. There is no indication that users may opt into another language or that the Chinese-only constraint is required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L725 states that the skill requires no additional API key, which implies a self-contained setup. However, L726-L728 immediately describe configuring external-tool keys and even prescribe a credential storage path, contradicting the earlier claim and creating a misleading impression about the skill's operational requirements.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 765)May include surrounding context.

md

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.