Back to skill

Security audit

Aky Public Opinion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only Chinese public-opinion report template package with no executable code, persistence, credential handling, or hidden data movement.

Install this if you want Chinese-language institutional public-opinion report drafting. Users who need English, bilingual, or non-official-document style output should be aware the skill strongly defaults to Chinese formal report conventions.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly requires Chinese-only output regardless of the user's language or preference. This can override user intent and reduce transparency, informed consent, and usability for users who do not read Chinese, especially in a high-stakes policy or risk-analysis context where misunderstanding the output could lead to incorrect decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template explicitly requires a specific Chinese-language report tone ("调研报告 tone") rather than offering language or locale choice. This is a natural-language policy issue because the file sets a mandatory language/style constraint without documenting user opt-in or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The guidance says "一是/二是/三是 is the preferred enumeration format" and uses Chinese opening formulas as required style. This imposes a locale-specific output convention without indicating user opt-in or a documented justification for always using that language format.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The general writing standards prescribe a single formal official-document style and pair it with stock phrasing from a specific language context. While style guidance is acceptable, here it appears mandatory and locale-specific without any user selection or documented regional requirement.

Content

No source excerpt is available for this finding.