Security audit

Chief

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent HR diagnostic assistant, but it can automatically store sensitive HR case details and use external tools without enough user-facing control.

Install only if you are comfortable with a Chinese-language HR diagnostic workflow that uses local HR knowledge-base files and may persist case details. Before using it with real employee, compensation, investigation, or legal-risk data, configure a dedicated KB path, avoid --force unless you intend overwrites, require explicit approval for case/taxonomy writes and external searches, redact PII, and review or fix the citation checker.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:279
Finding: Unscoped Skill Instructions Claim Highest Priority and Override Normal Session Behavior
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:917
Finding: Attacker-Controlled Diagnostic Content Is Persisted and Reused as Agent Memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/citation_checker.py:59
Finding: Citation Verification Fails Open and Accepts Ambiguous Substring Matches
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/citation_checker.py:136
Finding: Unescaped Citation Data Allows XML Output Injection
Content: View full analysis
') print(f' {"pass" if all_passed else "fail"}') for r in results: status = "pass" if r["passed"] else "fail" print( f' {r["message"]}' ) print('') ``` ### Technical Analysis The citation value and verification message are interpolated directly into XML. Neither XML attribute escaping nor element-text escaping is applied. Citation text originates in the report and can contain quotation marks, angle brackets, ampersands, and other XML metacharacters. A crafted value can terminate the `citation` attribute and inject new attributes or elements. At minimum, it can reliably produce malformed XML and cause a downstream parser failure. Depending on how the Constitutional Evaluator consumes duplicate or injected elements, it may also spoof status-bearing nodes. The extraction expression excludes only the closing square bracket from citation content. It does not prevent XML metacharacters or quotation marks from reaching this output path. ### Attack Path 1. An attacker places a crafted citation annotation in a report. 2. `extract_citations` accepts the payload because it contains no closing square bracket before the intended terminator. 3. Verification stores the attacker-controlled value in the result dictionary and includes it in an error or success message. 4. The `--xml-output` branch inserts the value into an XML attribute and element body without escaping. 5. The generated document becomes malformed or contains attacker-injected XML structure. 6. A downstream evaluator fails to ...[truncated 676 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to perform HR analysis, but it also describes knowledge-base initialization, template generation, and file creation/overwrite behavior including forceful writes. That is materially different from analysis-only behavior and can lead to unauthorized persistence, accidental overwrite, or silent modification of local HR documents.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to perform HR analysis, but it also describes knowledge-base initialization, template generation, and file creation/overwrite behavior including forceful writes. That is materially different from analysis-only behavior and can lead to unauthorized persistence, accidental overwrite, or silent modification of local HR documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that analyses may be automatically written to case memory and failure taxonomy, but it does not provide a clear user-facing warning or consent step. In HR contexts this is particularly dangerous because the stored content may include employee performance, compensation, disputes, or organizational-risk details that are sensitive and regulated.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs use of web search and external skills during analysis without a clear warning that user-provided HR data may be transmitted to external services. Because HR investigations often involve salary, performance, conduct, and labor matters, sending raw context to outside tools can cause confidentiality breaches and compliance issues.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes file read/write capabilities and local knowledge-base initialization behavior, but it does not declare any explicit tool scope or permission boundary. That creates an authorization gap: a caller or hosting runtime may not realize the skill can access or persist data on disk, increasing the chance of unintended file access or modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description says the skill is '不适用于简单问答、政策查询、模板生成、邮件起草等日常 HR 事务', implying those uses are outside the skill's scope. However, the same file later instructs the agent to directly answer policy queries, generate JDs/templates, and perform simple operations in normal mode, which broadens behavior beyond the stated purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The implicit trigger table includes generic terms like "为什么", "最近", "感觉", and broad patterns such as "干部怎么培养", which overlap with ordinary user queries rather than clearly signaling a request for this specialized workflow. Although the skill asks for confirmation before entering the mode, the activation criteria themselves are still ambiguous and insufficiently constrained, increasing the chance of unnecessary invocation prompts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The core description and overview consistently frame the skill as a deep organizational diagnosis engine for complex HR analysis. In contrast, the normal-mode routing table explicitly allows direct template generation and simple operational requests, including '帮我写个JD', which is materially different from diagnostic analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic case-memory writing introduces persistent storage of user analysis content, organizational context, and outcomes beyond the immediate response. In an HR setting, that can capture highly sensitive personnel, culture, or labor-risk data and retain it without clear minimization, consent, or retention controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all skill framework descriptions in Chinese and does not indicate that users can choose another language. The policy explicitly calls for flagging language or locale constraints when a skill forces a specific language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document mandates operational behavior in Chinese and does not indicate that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The spec instructs the evaluator to append records to FAILURE_TAXONOMY.md, which is a persistent side effect outside a narrowly scoped quality-checking role. In an agent setting, this can cause unauthorized repository modification, pollute project state, and create a pathway for prompt-driven file writes without explicit user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown directs appending failure records to a repository file without any notice that the skill may modify files. This violates user expectation and safe agent design, because a read/evaluate task can silently become a write operation affecting versioned artifacts or downstream automation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and introductory text specify output examples in Chinese and present them as the standard for LLM responses. This enforces a specific language/locale in natural-language guidance without any user opt-in or explanation that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions in Chinese and does not provide any opt-in, alternative language, or explanation that the skill is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description and all instructional content are written in Chinese, and there is no natural-language indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a reportable locale-policy issue unless the regional limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and section headings are written primarily in Chinese, and the file presents the skill workflow and outputs in Chinese without indicating that users may choose another language. This can violate a language/locale policy when the skill implicitly enforces one language by default without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description, headings, instructions, and examples are all presented in Chinese, and the file does not indicate that use of Chinese is optional or limited to a region-specific context. This can violate language/locale policy when a skill effectively forces one language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description, headings, instructions, and required output conventions are entirely in Chinese, and the guardrails state mandatory execution requirements without any indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and the full instructional content are written entirely in Chinese, and the file does not indicate that the skill is region-specific or provide any language/locale opt-in. This can violate language-choice policy by implicitly requiring a specific language for use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill file uses Chinese for the manifest description and instructional content, which effectively forces a specific language for users. Under the policy, language constraints should either be optional or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description, headings, instructions, template fields, and examples are all written to direct operation in Chinese, and there is no indication that users may choose another language. This creates a natural-language locale constraint that is not opt-in and is not justified as a region-specific or compliance-bound skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The architecture document explicitly routes '工具/模板任务' and other non-diagnostic requests to direct execution, while the skill metadata states the skill is intended only for deep HR diagnosis and is not suitable for routine tasks like template generation or drafting. This creates a scope mismatch that can cause the agent to handle requests outside its declared safety and operational boundaries, increasing the chance of misuse, poor controls, or accidental invocation in unsupported contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document title and all required template content are written as mandatory Chinese output, and nowhere does the specification indicate that another language may be used based on user preference. This creates a natural-language locale constraint without opt-in, which matches the policy category for forced language behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template explicitly includes a <tot_paths_raw> field for '完整推理日志' inside the generated XML while also claiming it is '仅存储，不传递'. In practice, scaffolds like this are often followed literally by agents, so placing raw reasoning in the output structure materially increases the chance of chain-of-thought or internal analysis leakage to users, logs, downstream tools, or other agents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.