Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
Bilingual Buddy
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed bilingual formatting skill, but users should avoid entering secrets because it asks the agent to repeat and translate each message.
Install this only when you want bilingual learning output. Do not paste passwords, tokens, financial details, medical information, addresses, or other private text while it is active, because the skill instructs the agent to restate and translate user input before answering.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes broad phrases like bilingual, language learning, teach Chinese/English, and child-learning phrasing that can match many ordinary requests. This can cause the skill to activate unexpectedly and override safer default behavior, especially by forcing multilingual formatting and input mirroring in contexts where users did not clearly request it.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Mandating that every user message be mirrored before replying creates a standing requirement to repeat whatever the user typed, including secrets, personal data, regulated information, or harmful content. Translating and retranscribing that content into multiple representations further amplifies exposure by restating sensitive data in plain text and alternate forms.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill infers that a Chinese-language user is a Chinese speaker and an English-language user is an English speaker, then steers formatting choices based on that assumption. This can misclassify multilingual users, produce inappropriate disclosures or nudges, and change response handling without an explicit user preference.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The explicit rule that mirrored user input must never be omitted prevents the model from applying safety discretion when the user message contains passwords, financial details, personal identifiers, or abusive material. Because it is framed as an absolute instruction, it increases the chance of repeated disclosure in logs, screenshots, and shared conversation history.
- Content
Static analysis
No suspicious patterns detected.