Security audit

On-Demand Expert Team

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for orchestrating temporary expert teams, but it can automatically progress into multi-agent execution with write and shell permissions without a clear consent checkpoint.

Review this skill before installing. It is not showing clear malicious behavior, but users should only invoke it intentionally, prefer read-only mode for exploratory tasks, and require explicit confirmation before it writes files, runs Bash validation, creates subagents, or turns a temporary team design into reusable prompt or asset material.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The catalog explicitly allows converting a temporary on-demand expert team into reusable assets, including 'series prompts' and packageable artifacts, which conflicts with the skill's stated design of inline-only prompt generation that should not persist. This creates a policy drift path where ephemeral orchestration prompts can be retained, reused, or redistributed, increasing the chance of prompt leakage, privilege carryover, and unreviewed propagation of powerful instructions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The requirements explicitly allow a later '固化建议' output in the form of '组建方案+系列提示词，或可上架资产包', which conflicts with the earlier claim that prompt content is only generated inline and not delivered as a reusable artifact. This inconsistency can cause the agent to produce reusable prompt packs or packaged assets that persist beyond the temporary-run model, increasing the chance of unsafe prompt leakage, policy bypass reuse, or unreviewed automation artifacts being distributed.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document states a strict temporary, inline-only prompt policy and says prompts/design docs should not be persisted, but later sections permit reusable prompt-series guidance. Contradictory lifecycle rules are dangerous because downstream implementations may choose the more permissive branch, resulting in retention or export of prompts that were supposed to remain ephemeral.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad and semantically overlapping, including generic terms like '拉起专家团', '组团跑任务', and especially 'meta-skill-system'. This can cause unintended invocation in unrelated conversations, leading the agent to activate file access, shell use, or multi-step orchestration behavior without the user clearly intending to run this powerful skill.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly permits Write/Edit and Bash/script execution, but the user-facing description does not prominently warn that it may modify files or run commands. In practice, that can surprise users and increase the risk of unintended system changes, especially because the skill is designed to operate end-to-end and autonomously once triggered.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The instruction to proceed immediately into the next phase without waiting for confirmation reduces user control over workflow progression and can cause the agent to initiate additional steps the user did not explicitly approve. In a meta-skill that dynamically assembles and runs an expert team, this increases the chance of unintended actions, extra tool use, or over-collection/processing before the user can intervene.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the system to finalize the execution plan and 'immediately enter OD1' without waiting for confirmation, while team creation and workflow execution may involve launching subagents and progressing through a multi-stage process. In an agentic environment, automatic escalation from planning to execution without an explicit consent checkpoint can trigger unintended actions, excessive resource use, or processing of sensitive materials the user did not mean to authorize yet.

Static analysis

No suspicious patterns detected.