Security audit

Domain Prompt Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a text-only prompt generator with no code or persistence, but it broadly enables actionable prompts in sensitive areas such as medical treatment without clear safety limits.

Review this before installing if you expect safe handling of medical, financial, cybersecurity, political, or other high-impact prompt generation. The package appears text-only and does not install code or access local data, but users should add their own safety limits or avoid using it to generate actionable medical treatment or similarly regulated advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The health and medical examples generate diagnosis, drug, treatment, and intervention plans without any warning, limitation, or referral to qualified professionals. In this skill's context, which is designed to turn arbitrary topics into executable prompts, that omission materially increases the risk of users obtaining unsafe self-treatment or medical decision support framed as actionable protocol.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises very broad trigger phrases such as '提示词生成', '领域模板', and '目标输出', which can overlap with ordinary user requests and cause the skill to activate in contexts where the user did not intend to invoke it. Because this is a meta-template engine that can reshape arbitrary topics into executable-style prompts, accidental invocation can override normal instruction handling, introduce prompt-scope confusion, or route benign requests into an unnecessary higher-privilege transformation workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill file is written as a Chinese-only operating description and does not indicate that users may choose another language. This can violate language/locale policy when a skill effectively constrains interaction to one language without explicit user choice or documented regional justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation text is highly generic and can be invoked for essentially any 'domain topic' with arbitrary atomic elements and target outputs, without clear scoping, safety gating, or trigger constraints. In a prompt-generation skill, this broad invocation surface increases the chance the skill is used to generate unsafe, policy-bypassing, or unintended task prompts across sensitive domains.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains natural-language instructions exclusively in Chinese, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: All headings, instructions, and exemplar prompts are presented exclusively in Chinese, and the file does not mention that the skill is Chinese-only or provide an opt-in language choice. This can constitute a language/locale policy issue when users are not given a documented choice or rationale for the restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The standard template uses highly generic placeholders like '[领域主题]' and '[目标输出]' with no scoping, allowlist, or exclusion guidance. In a meta-prompt skill, that makes the activation surface extremely broad and can be repurposed to generate instructions for sensitive domains, including medical, security, or other high-risk content, without built-in constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The repeated '执行协议等待指令' exemplars are phrased as reusable, broadly applicable command patterns that can match many ordinary requests and steer the model into a templated execution mode. Because the library spans many domains and includes sensitive areas, these ambiguous triggers increase the chance of over-activation and unsafe prompt generation outside intended contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown embeds a fixed Chinese instruction template as the expected output format, and the file provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This example hard-codes the operational prompt in Chinese and does not mention any option to switch languages. Because the file presents the template as directly usable, it effectively imposes a locale/language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file repeats a directly usable prompt entirely in Chinese and does not state that the language is optional, selectable, or required for a specific compliance context. That constitutes a language policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The report section again embeds the same Chinese-language prompt as the final recommended output, but the document never offers users a choice of language or explains a justified locale restriction. This is a repeated natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The exemplar uses a highly generic invocation phrase ('执行协议等待指令') and broad domain decomposition pattern without clear activation boundaries, which can cause the skill to engage on unintended user inputs. In a meta-prompt generator, this is more dangerous because generated prompts may be reused across domains and inherit the same overbroad activation behavior, increasing prompt confusion and unintended execution risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The entire skill exemplar is written in Chinese and all examples, labels, and expected outputs are presented only in Chinese, with no indication that users may choose another language. Under the policy rule for language or locale constraints, this can be treated as a natural-language policy issue unless the language restriction is explicitly justified or made opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. That can conflict with language/locale policy requirements when user opt-in is expected.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document provides only positive-path construction examples and lacks negative examples, refusal conditions, or scope limits for activation. For a meta-skill that generates reusable domain prompts, this omission can propagate unsafe prompt patterns that activate too broadly or fail to distinguish normal discussion from explicit invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file presents all instructions, examples, and outputs exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language context. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
Content: No source excerpt is available for this finding.