Security audit
Security checks for vulnerabilities and agentic risk
This static taxonomy skill is not malware, but it needs Review because it includes high-impact workflows like payments, medical care, permissions, and data destruction without strong safety gates.
Install only if you want a broad Chinese-language workflow taxonomy and keep it to planning or reference use by default. Do not let it directly execute payments, trades, permission changes, data deletion, clinical or mental-health decisions, chemical operations, or security changes unless separate trusted tools, human approvals, professional oversight, and audit controls are in place.
技能清单描述该技能应提供“人类活动领域穷尽分类体系”、6×6矩阵分类、108母域和领域定位能力；但该文件实际内容是化工生产任务的操作性要求清单，涵盖采购、反应、分离、精制、环保等具体流程模板。它并未体现领域分类、矩阵映射或分类索引功能，而是在定义特定行业流程产出要求，和声明的分类元技能用途存在明显语义偏离。
The document provides procedural guidance for chemical production workflows, including reaction design, control, monitoring, separation, refining, and storage, but omits explicit user safety warnings, hazard identification, and escalation boundaries for high-risk chemical operations. In this context, the skill can operationalize hazardous real-world activities, so the absence of safety guardrails increases the risk of unsafe use, especially by unqualified users.
The manifest describes a skill for exhaustive classification of human activity domains using a 6×6 matrix and 108 parent domains. This file instead defines a template index and workflow for data collection, cleaning, analysis, and visualization exemplars, which is a materially different purpose from domain classification.
The file’s content materially diverges from the declared skill purpose: instead of human-activity domain classification, it provides a general data-analysis workflow covering collection, cleaning, modeling, visualization, and reporting. This scope mismatch is dangerous because an agent or user invoking a seemingly harmless classification skill could be induced to perform broader data-processing actions, including data access and ML tasks, outside expected boundaries and review assumptions.
The manifest includes a non-specific catch-all term, notably 'meta-skill-system', without clear activation boundaries or required context. Catch-all triggers are dangerous because they can make the skill eligible in many unrelated conversations, increasing the chance of accidental invocation, instruction collisions with other skills, and misrouting across the skill ecosystem.
The family placement section covers spouse employment and children's education, which necessarily touches highly sensitive third-party and family data. Providing workflow instructions for gathering and acting on this information without safeguards, consent procedures, or special handling requirements creates elevated privacy and legal risk, especially for dependents who may not be direct participants.
The skill explicitly includes '支付交易执行' and '完成资金划转' but does not require any user authorization, approval workflow, confirmation step, or warning that the action can move real funds and may be irreversible. In an agent skill context, this omission is dangerous because it can normalize or enable autonomous execution of high-impact financial actions based only on task assembly requirements.
The settlement section directs '资金划拨执行' and completion of settlement transfers without stating validation, approval, reconciliation prerequisites, or warnings about irreversible financial effects. In a skill that may be used by an automated agent, this creates a real risk of unauthorized or erroneous settlement transfers at scale.
The file is supposed to support a classification/meta-skill, but instead contains detailed operational requirements for foreign exchange trading workflows. This scope drift can cause an agent to perform or facilitate regulated financial activity beyond its declared purpose, increasing the risk of unsafe automation, compliance violations, and misuse by downstream systems that trust the skill metadata.
This section explicitly covers executing inter-account fund transfers but provides no user-facing warning, confirmation controls, or mention of irreversible financial consequences. In an agent skill context, operational instructions for money movement without strong cautions and approval gates can enable accidental or unauthorized transfers, causing direct financial loss.
The file defines a full operational permission-management workflow, including planning, assignment, activation, monitoring, audit, change, and revocation, while the skill manifest claims the skill is only for human-activity domain classification and indexing. This capability mismatch is dangerous because it can hide privileged access-governance functionality inside a seemingly harmless taxonomy skill, enabling misuse or unexpected automation of sensitive access-control tasks.
The document includes unjustified access-control operations such as permission activation, usage monitoring, auditing, anomaly handling, change processing, and revocation, none of which are necessary for a classification-only skill. In context, these instructions increase risk because they could be invoked to support real privilege administration and surveillance under a misleading or overly broad skill identity.
The skill is explicitly framed around medical diagnosis, treatment, and patient management in a safety-critical domain, yet it provides no warning that outputs may affect real-world diagnosis or treatment decisions. That omission increases the risk that users or downstream agents treat the skill as authoritative clinical guidance without appropriate human oversight, creating a credible path to patient harm.
The file defines diagnostic, testing, treatment, medication, surgery, and nursing tasks as operational capabilities without any explicit limitation that outputs are informational only or that licensed clinician oversight is required. In a medical skill, this omission can cause users or downstream agents to treat the system as authorized to provide or execute clinical decisions, creating a substantial risk of harmful medical advice or unsafe autonomous action.
The skill explicitly presents capabilities for psychological assessment, diagnosis, report generation, treatment, and crisis intervention, but it provides no visible safety boundary stating that the agent is not a licensed clinician, cannot replace emergency care, and must escalate self-harm, suicidality, or acute psychiatric crises to immediate human support. In a mental-health context, omission of those safeguards can cause users to rely on the system for high-stakes clinical judgment or emergency intervention, increasing the risk of delayed care and harmful advice.
The crisis-intervention section describes identifying crisis signals, assessing severity, executing interventions, and follow-up, but omits any requirement for immediate escalation to qualified human professionals or emergency services. Because mental-health crises can involve imminent self-harm or harm to others, an agent or user relying on this workflow alone could delay life-critical intervention or attempt unqualified crisis management.
This file enumerates mental-health assessment, diagnosis, treatment, and crisis-intervention exemplar workflows, including risk assessment and intervention tasks, without any visible safety boundary, emergency disclaimer, or requirement for qualified human oversight. In a skill system, that omission can encourage unsafe imitation or overreliance in high-stakes contexts such as suicidality, acute crisis, or clinical diagnosis, increasing the risk of harmful guidance being produced or operationalized.
The file materially expands the skill from a taxonomy/classification function into operational psychological service delivery, including assessment, counseling, treatment, and crisis intervention. This creates dangerous capability drift: an agent presented as a neutral domain-classification tool could be used to generate or structure quasi-clinical mental health workflows without the safeguards, qualification checks, and risk controls required for such high-stakes use.
The document grants the skill structured authority to perform psychological diagnosis, treatment execution, treatment monitoring, and crisis intervention, which are professional clinical functions. In an LLM skill, this is especially dangerous because users may interpret the generated outputs as actionable mental-health guidance, leading to delayed care, inappropriate interventions, or unsafe handling of acute psychiatric risk.
The crisis-intervention section discusses identifying crisis signals, assessing severity, executing interventions, and follow-up, but provides no emergency warnings, escalation thresholds, or instructions to contact local emergency resources or suicide/crisis hotlines. In high-risk mental-health contexts, omission of these safeguards can directly contribute to harmful delay, false reassurance, or unsafe self-management during imminent danger.
技能清单描述的是一个用于人类活动领域分类与定位的元技能，但该文件实际提供的是“20-设施维护-01-设备维修”场景下的范本索引、样本分析流程和用户填充指南。其核心行为语义是内容仿写与范本管理，而不是领域分类体系或6×6矩阵/108母域索引能力。
The file content is materially inconsistent with the declared skill purpose: instead of a human-activity classification taxonomy, it defines actionable IT operations workflows such as monitoring, fault repair, performance tuning, and security operations. In an agent skill system, this kind of scope drift is dangerous because it can cause the agent to invoke operational or security-sensitive behavior under a misleading taxonomy/classification label, bypassing user expectations, policy routing, or safety review boundaries.
The file’s actual behavior and content are for a network-security exemplar library and sample-imitation workflow, which does not match the declared skill capability of human-activity domain classification. This kind of capability/content mismatch is dangerous because it can route users into unintended functionality, bypass review expectations, and enable prompt-scope expansion through seemingly unrelated reference material and user-supplied exemplars.
The file’s content is materially inconsistent with the declared skill purpose. A skill advertised as human-activity domain classification but containing detailed database operations requirements can cause an agent to perform or generate guidance for sensitive infrastructure tasks outside the user’s expected scope, increasing the risk of unsafe privilege use and policy bypass through capability smuggling.
The manifest says this skill provides a 6×6 matrix taxonomy for classifying human activity domains and domain positioning. However, this file is a requirements document for accounting tasks such as voucher processing, ledger management, financial statements, and accounting supervision, which is a distinct business workflow rather than a domain-classification capability.
No suspicious patterns detected.
