T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:310- Finding
Automatic Persistence of Untrusted Task Content into Cross-Task Knowledge Files
- Content
View full analysis
- Remediation
View remediation
Security audit
创意策源引擎
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent creative-planning assistant, but it can auto-activate on broad prompts, perform web research, and automatically store task-derived ideas across projects without clear user consent or retention controls.
Review this skill before installing if you may use it for confidential product ideas, market strategy, client work, or internal plans. Prefer explicit invocation, disable or review any automatic memory writes if the host allows it, and confirm before web research so sensitive terms are not sent to external search services unintentionally.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says the skill will auto-activate when it detects broad intent categories like planning, creativity, or brainstorming, which are common in ordinary conversation. That can cause unintended invocation, expanding the skill’s access to user prompts and potentially triggering downstream behaviors such as multi-agent processing or network research without clear user intent.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list contains very broad everyday terms like '策划', '创意', '方案', and '帮我想想', making the skill likely to auto-activate in many ordinary conversations. In this skill's context, unintended activation is more dangerous because activation can launch multi-agent workflows, web research, and automatic knowledge persistence, causing unnecessary data processing and possible storage of user content without clear intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that the data-anchoring agent 'must execute network search' but gives no warning that user-supplied ideas or derived queries may be sent to external services. In a creativity and business-planning context, prompts may contain confidential product concepts, strategy, or proprietary market hypotheses, making silent outbound transmission a real privacy and data-handling risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The direct trigger example uses very generic phrasing like '帮我策划一个 {创意描述}', which overlaps heavily with normal chat. If the platform relies on phrase matching or loose intent detection, users may invoke the skill accidentally, causing unexpected processing and possibly external lookups tied to the skill’s workflow.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Manifest 在 L004 明确承诺最终交付包含“Skill双格式输出”，但后续输出结构与执行协议只定义了策划案、评分卡、来源表、三Agent原始输出，以及任务后知识沉淀，没有任何单独的 Skill 文件结构或生成步骤。这属于对外宣称的核心交付形式与文档中实际操作流程不一致。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation examples remain open-ended and insufficiently constrained, reinforcing the risk that the platform will interpret generic brainstorming requests as permission to invoke the full skill. Because this skill may perform external research and persistent writes, ambiguous activation expands unintended collection and processing of user inputs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill declares automatic cross-project knowledge accumulation into persistent files under topics/*.md, but its stated purpose is ordinary creative planning and feasibility analysis rather than long-term data retention. This can silently store user ideas, business concepts, or sensitive project details across sessions, creating privacy leakage and unintended data reuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill describes automatic knowledge persistence but provides no user-facing warning that project data may be written to files. This is dangerous because users may share confidential business ideas, product plans, or internal strategy material during brainstorming, and silent persistence can expose that data to later tasks, operators, or other workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
L415 要求 Agent γ 必须执行网络搜索，且前文多次强调所有数字必须附来源；但 L435、L451、L465 的示例摘要列出大量具体市场规模、增长率、月活、客户量等数字，却未给出任何来源链接或可追溯标注。这使文档中的规范性要求与其展示的“实际使用示例”存在明显背离。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This manifest embeds the skill name, description, and operational instructions exclusively in Chinese, which effectively forces a specific language for users and downstream outputs. The file does not provide any user opt-in, alternate language option, or justification that the skill is intentionally region-specific.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains broad, everyday phrases such as '帮我想想' and generic planning/idea terms that are likely to appear in many unrelated conversations. This can cause unintended skill activation, routing user input into the skill without clear user intent, which may create privacy, UX, and prompt-scope risks in agent platforms that auto-select skills based on triggers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing natural-language content exclusively in Chinese, but provides no indication that the skill is region-specific or that language choice is optional. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The README presents the skill entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is documented and justified.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The single-word trigger '策划' is too broad and can match many benign requests unrelated to this specific skill. Given the skill's expansive behavior—multi-agent orchestration, possible web access, and documented persistence—accidental invocation can cause unnecessary external calls and retention of user-provided information.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The trigger '创意' is a generic everyday noun and is likely to appear in normal discussion, making false activations probable. In this skill's context, those false activations are not harmless because they can trigger web research and downstream storage of user ideas across projects.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The trigger '方案' is highly ambiguous and can refer to almost any plan, answer, or option in ordinary conversation. Because the skill includes broad orchestration and persistence features, such a short trigger increases the chance of unintended execution and inappropriate handling of user content.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
L036-L038 将系统描述为多Agent并行辩论式架构，容易让人理解为多个独立 Agent 共同构成完整对抗网络；但 L345-L350 的执行协议只明确并行启动 α/β/γ 三个 Agent，Critic 和 Defender 更像串行分析阶段而不是独立 Agent 实体。这会造成对实现形态的夸大式表述，与实际文档化执行方式存在语义偏差。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill name and description are entirely in Chinese, and the manifest does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy expectations when a skill is exposed on multi-language platforms without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.