Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
Операционный директор
Security checks for vulnerabilities and agentic risk
Overview
This skill is a read-only Russian business-summary helper over bundled demo/test data, with no evidence of credential use, network access, persistence, or data mutation.
Install this only if you want a Russian-oriented business-summary assistant that reads its packaged demo/test snapshot. Be aware it may activate on broad business or money-related prompts and on numbered follow-ups, but it does not perform banking actions or modify data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the host to execute a local Python script and implicitly depends on reading local files/data, but it does not declare explicit tool scope such as permissions or allowed-tools. This weakens least-privilege enforcement and can let a runtime grant broader access than reviewers expect, especially since the skill insists on automatic execution on the first substantive turn.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger guidance is very broad: phrases like 'как бизнес?', 'что с деньгами?', 'что горит?' and even 'ответов 1/2/3' can occur in ordinary conversation and are paired with an instruction to immediately run the script. This creates a real risk of unintended activation and unnecessary access to sensitive local business snapshot data without sufficiently explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill says to 'answer the user's intent rather than seek exact phrase matching,' which further expands activation beyond a bounded trigger set. In context, that is more dangerous because activation leads to script execution against local business data, so false positives can expose sensitive financial and operational information unnecessarily.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The display name, short description, and default prompt are all written in Russian, which imposes a specific language/locale in the skill's user-facing interface. The file does not indicate that this language choice is optional, user-selected, or justified as a region-specific skill.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s headings and instructions are fully in Russian, and there is no natural-language indication that the user can choose another language or that the skill is intentionally restricted to Russian-speaking or region-specific use. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The embedded response guidance is entirely prescriptive in Russian and directs how the assistant must answer, including fixed closing text. This creates a language/locale constraint without offering the user a choice or documenting a justified region-specific limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code embeds Russian-only natural-language strings, including the source marker and month names, and formats all rendered dates in Russian. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present in this file.
- Content
Static analysis
No suspicious patterns detected.