小沐宝咖啡

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent coffee-stall helper, but it under-scopes child safety and privacy around location, social posts, photos, and contact details.

Review before installing. The skill appears intended for a family coffee-stall workflow and does not contain executable malware, but it should be tightened before public use: avoid precise public location schedules for a child, require adult review for any post with time/location/photos, use an adult-managed public channel for updates, do not collect customer contact details informally, and narrow triggers to brand-specific terms.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to answer in a fixed '7-year-old girl' persona, which can override normal assistant behavior without clear user opt-in. This is primarily a safety and UX issue: users may receive role-played responses when they expected neutral assistance, and the child persona can increase persuasion or emotional trust in ways users did not request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The auxiliary trigger list contains broad everyday terms such as '菜单', '摆摊', '咖啡摊', and '拉花', which can match many unrelated conversations and cause unintended activation. In practice this can hijack normal chat flow, inject the skill's branded instructions unexpectedly, and increase the chance that persona constraints or other skill behaviors override user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The auxiliary trigger list includes broad everyday coffee-related terms such as '拉花' and '手磨咖啡', which can cause the skill to activate in conversations that are not actually about this specific brand. This creates prompt-routing risk: unrelated user queries may be handled by the wrong skill, leading to confusing responses, brand/persona leakage, or reduced reliability of downstream actions.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill enforces a fixed childlike Chinese persona and specific forms of address without accommodating the user's language, tone, or context. While not a direct security exploit, this can cause inappropriate or manipulative responses in unrelated settings, and increases the risk of unsafe impersonation or trust-shaping if the skill is triggered accidentally.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The template explicitly prompts publishing a child's current time and location for a mobile coffee stall, which creates a real-time stalking and child-safety risk. In this skill's context, the danger is elevated because the business is operated by a 7-year-old girl, making precise schedule/location disclosure especially sensitive.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This content suggests collecting customer contact information without any privacy notice, consent language, or instruction that only a guardian should handle such data. Because the operator is explicitly a 7-year-old child, the absence of adult-controlled collection and safeguarding makes the privacy issue more serious than in an ordinary retail script.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script invites customers to send photos or videos to the child's father without mentioning consent boundaries, appropriate sharing methods, or risks of distributing media involving a minor. This can normalize informal sharing of child images and create privacy and safety issues for the child and the family.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The document publishes a minor's specific recurring times and likely locations for future appearances, including neighborhood-level details and a history of past outings. Because the skill is about a 7-year-old girl's mobile coffee stall, this materially increases stalking, harassment, and physical safety risk; the child-focused context makes the exposure significantly more dangerous than for an adult-run business.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The schedule tool is explicitly designed to return future date, location, and operating time data for a mobile coffee stall run by a 7-year-old child. Publishing or programmatically exposing precise whereabouts and timing for a minor materially increases stalking, harassment, and physical safety risks, and the family-oriented context makes this more sensitive than an ordinary business schedule feed.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest defines the assistant persona, tone rules, and example responses entirely in Chinese, including mandatory phrasing such as using specific Chinese kinship terms for customers. This indicates a fixed language/locale behavior without offering the user a choice or documenting a justified region-specific constraint.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese, and there is no note that the skill is intended only for Chinese-speaking users or that another language option is available. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file presents all user-facing content exclusively in Chinese, which can violate a language/locale policy when no user opt-in or alternative language is offered. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented locale constraint.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The template encourages sharing stories about identifiable customer interactions and suggests including people-related narrative content, which can expose third parties without consent. Although it recommends blurred back-view images, there is no explicit requirement to anonymize details, obtain consent, or avoid recognizable descriptions, creating avoidable privacy risk.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The template encourages asking customers to leave contact information for future stall notifications, but it provides no data-minimization, consent, retention, or guardian-handling guidance. In the context of a child-run coffee stall, collecting personal contact details creates unnecessary privacy risk and can expose both customers and the child/family to misuse or oversharing.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: Referring customers to the father's social feed for updates can expose personal social account information and create ongoing contact expectations. The markdown lacks any warning that a dedicated public or business-facing account should be used instead of a personal account.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The document uses Chinese throughout for headings, instructions, and status labels, which imposes a specific language on readers without any opt-in or stated regional justification. Under the policy rule for language or locale constraints, this is a natural-language policy concern because no alternative language option is provided.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: `generate_moments_copy` creates social-media posts for Moments/朋友圈, extending the skill from answering coffee-stall questions into marketing content generation. While loosely related to operations, that capability is not an obvious requirement of a coffee information lookup skill and is especially sensitive given the branding centers on a 7-year-old child.

Static analysis

No suspicious patterns detected.