Security audit

beijing-jifen-consult

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local Beijing points-settlement calculator, with the main caveat that entered personal details are auto-saved in the browser until cleared.

Use this on a trusted device or browser profile, because birth month, residence, employment, tax, and legal-record-related entries are saved locally in browser storage. Clear the saved records after use, and treat all outputs as unofficial simulation only.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: assets/beijing-jifen-wizard.html:1521
Finding: Automatic Plaintext Persistence of Sensitive Personal Information
Content: View full analysis
= 2) data.degreeDeduct = ymReadSafe(dp[0]) + "|" + ymReadSafe(dp[1]); return data; } function saveForm(){ if (restoringForm) return; try { localStorage.setItem(FORM_CACHE_KEY, JSON.stringify(collectFormState())); } catch (e) {} } ``` The storage operation is automatically connected to form activity at lines 1627-1630: ```javascript if ($("#wizardForm")) { $("#wizardForm").addEventListener("change", saveForm); $("#wizardForm").addEventListener("input", saveForm); } ``` ### T ...[truncated 2706 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- 可视化模式：打开 `./assets/beijing-jifen-wizard.html`，用户与 AI 在页面上共同填写、算分、解读结果和讨论规划。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- 可视化模式：打开 `./assets/beijing-jifen-wizard.html`，用户与 AI 在页面上共同填写、算分、解读结果和讨论规划。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
- 可视化模式：打开 `./assets/beijing-jifen-wizard.html`，用户与 AI 在页面上共同填写、算分、解读结果和讨论规划。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
- 可视化模式：打开 `./assets/beijing-jifen-wizard.html`，用户与 AI 在页面上共同填写、算分、解读结果和讨论规划。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger text is extremely broad: it activates on calculating points, checking eligibility, asking how to fill fields, asking about rules, future planning, or general consultation. Such breadth can cause the skill to intercept common advisory requests beyond a narrowly scoped intent, increasing the chance of inappropriate activation, privacy over-collection, and user confusion about when this specialized workflow should run.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The page collects highly sensitive personal and quasi-eligibility data, including birth month, residence history, employment/social insurance history, tax-related violations, criminal-record-related assertions, and detention counts, then automatically persists it to localStorage on every change. localStorage is long-lived, readable by any script running on the same origin, and may remain accessible to other users of the same browser profile or via XSS/browser compromise, so silent persistence materially increases privacy and security risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The HTML sets the page language to zh-CN, and the entire interface is presented only in Chinese with no visible language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation unless the restriction is explicitly justified and documented.
Content: No source excerpt is available for this finding.