Security audit

Task Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it is a very broad task-orchestration and skill-generation system with under-scoped tool use, persistence, and automatic dependency-installation instructions.

Review before installing. This skill may be useful as a Chinese planning and skill-generation framework, but users should require confirmation before it writes files, creates or modifies skills, runs code, loads other skills, performs web searches with sensitive context, or installs task-ops as a dependency. Prefer explicit invocation over broad trigger matching and pin any dependency source before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/structure-template.md:34
Finding: Generated Skills Mandate Automatic Installation of an Unverified Dependency
Content: View full analysis
Vulnerability Details

File Locations:

references/structure-template.md, lines 34–39

references/utos-interface-checklist.md, lines 12–14

Vulnerability Type: Supply-chain risk caused by automatic installation of an unpinned dependency
Risk Level: Medium

Vulnerable Code Snippets

From references/structure-template.md:

markdown
**Loading check process** (execute whenever activated): 1. Detect whether the `task-ops` Skill is installed. 2. **Not installed** → automatically install the `task-ops` Skill. 3. **Installation successful** → load Task Ops and execute according to this Skill's usage rules. 4. **Installation failed** → degrade to **read-only reference mode**.

From references/utos-interface-checklist.md:

markdown
| A2 | SKILL.md contains a dependency declaration | Check whether SKILL.md contains a "Dependency Declaration" section | It must declare a strong dependency on task-ops | | A3 | Loading check process is complete | Check for the four-step process: detection → installation → loading → degradation | All four steps are mandatory | | A4 | Degraded mode is defined | Check whether a read-only permission table is present | Modes with and without Task Ops must be distinguished |

Technical Analysis

The generated Skill template directs an agent to install task-ops automatically whenever that dependency is absent. The installation instruction identifies the dependency only by its mutable name. It does not specify:

An approved registry or repository

A verified publisher identity

An immutable package version or commit

A cryptographic hash or signature

A trusted download URL

A permission review

Explicit user authorization before installation

The compatibility checklist makes the detect-install-load sequence mandatory. Consequently, this is not merely an optional example: domain Skills produced according to the documented workflow are expected to reproduce the unsafe installation behavior.

An ...[truncated 2034 chars]
Remediation: View remediation
Remediation Suggestions

Remove automatic installation

Replace the automatic-installation step with a safe failure message.

Permit read-only operation while the dependency is unavailable.

Require explicit user authorization

Display the dependency name, source, publisher, version, requested permissions, and integrity information.

Install only after the user gives informed confirmation.

Pin and authenticate the dependency

Specify an approved registry or repository.

Pin an immutable release version or commit.

Verify a cryptographic hash or trusted publisher signature before loading.

Apply least privilege

Restrict the dependency to the minimum required files, tools, network access, and execution permissions.

Do not inherit unrestricted installer or agent privileges by default.

Revise the compatibility checklist

Change item A3 from mandatory automatic installation to: detect → report verified installation instructions → obtain approval → install and verify, or degrade safely.

Validation should fail if a generated Skill performs an unattended installation.

Handle ambiguous resolution safely

Abort if multiple packages or publishers use the dependency name.

Never select a dependency solely by package-name similarity.

Record dependency provenance

Store the resolved source, version, publisher, checksum, installation time, and approval record for later audit and reproducibility.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes extremely generic terms like '执行', '内容', '任务系统', 'Pipeline', '工作流', and '任务分解', which are common in ordinary user requests. This makes accidental or over-broad activation likely, causing the skill to intercept unrelated tasks and potentially invoke its expansive planning/execution behaviors in contexts where the user did not intend to use it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains very broad, everyday terms such as '执行', '内容', '创新', '任务系统', and 'Pipeline', which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance that the agent applies this skill unexpectedly, changing task routing or behavior without clear user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operational instructions and descriptions are effectively presented in Chinese, but the file does not state that Chinese is optional or offer users a language choice. This can amount to a language/locale policy issue because it implicitly forces one language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that when '8+工具调用且有复用价值' it may '保存为新技能', which implies creating or modifying artifacts without an explicit user-facing confirmation step. In agent environments, implicit persistence can lead to unauthorized file creation, workspace modification, or durable behavioral changes that the user did not knowingly approve.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool-use section normalizes potentially impactful actions such as file read/write, external operations, code execution, and skill loading as routine implementation details, but does not present user-facing warnings, consent requirements, or boundary conditions. That omission increases the risk of silent side effects, unsafe data handling, or execution beyond user expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly authorizes broad execution mechanisms such as external tools, file operations, code execution, and loading other skills as generic implementations of pipeline steps. For a planning/operating-system style skill, this meaningfully expands capability scope beyond pure reasoning and creates a path from abstract task decomposition to real-world side effects without strong scoping, allowlists, or safety gates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents all instructions and user-facing interaction text in Chinese, including the activation-time prompt shown to users. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document is entirely written as a Chinese-only operating framework and does not offer any language choice or indicate that the user can select another locale. Under the language/locale policy, a skill should not force a specific language unless the constraint is justified or explicitly chosen by the user.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The framework explicitly instructs activation on a very broad user phrase pattern like '帮我做一个XX领域知识参考库', which can overlap with ordinary requests and cause unintended invocation. Over-broad triggers increase the chance that the skill hijacks unrelated conversations, applies domain-scaffolding where it was not requested, and bypasses more appropriate task-specific handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is defined so broadly that ordinary user requests for building a knowledge base or reference library may automatically activate this skill, even when the user did not explicitly intend to invoke it. In an agent system, this can cause unintended skill selection, overreach into file-generation behavior, and create opportunities for prompt hijacking or workflow misrouting through ambiguous natural-language inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document is written as the operative workflow in Chinese and includes a Chinese-only trigger phrase and interaction pattern, with no indication that users may choose another language. This can violate language/locale policy when a skill mandates a specific language without explicit opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and the entire skill specification are written only in Chinese, and the document does not indicate that users may choose another language or locale. Under the language/locale policy, a skill that effectively requires a specific language without opt-in or documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template hard-codes a Chinese-language field name ({技能中文名}) for the skill title, which implies the generated skill should use Chinese naming by default. This is a natural-language locale constraint without any opt-in, alternative language option, or justification that the template is intended only for a Chinese-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents the entire skill specification in Chinese and uses imperative language throughout, but does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing procedural instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file includes a trigger-like condition stating that refactoring can be initiated whenever one subjectively feels 'this workflow is too complex.' That condition is overly broad and lacks scope boundaries or exclusion examples, which could cause the skill to be applied in many ordinary contexts without a clear activation threshold.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title and the entire document are presented in Chinese, with no indication that language selection is optional or user-driven. Under the policy, a skill should not impose a specific language or locale unless it clearly offers opt-in choice or documents a justified regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

SkillSpector

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Vague Triggers

Natural-Language Policy Violations

Static analysis