Security audit

China Hot Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward hot-topic aggregation guide that uses live public web pages and does not install code, persist access, or handle credentials.

Install this if you want an agent to fetch current public hot-list pages from major Chinese platforms for trend monitoring and content ideas. Be aware that using it involves outbound requests to those sites, so avoid adding private account details or sensitive internal topics unless you are comfortable with that context being used during browsing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases include broad, everyday requests such as '最近什么火', '什么最热', and '帮我找选题', which can cause the skill to activate in contexts where the user did not intend to invoke external hot-topic aggregation. Because the skill is designed to fetch live data from multiple third-party sites, overbroad activation increases the chance of unintended browsing, data disclosure in prompts, and confusing or privacy-impacting behavior.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly performs live web_fetch requests to multiple third-party platforms but provides no user-facing notice, consent step, or explanation that external network access will happen. This creates a transparency and privacy risk because user queries may trigger outbound requests unexpectedly, and it also increases operational risk if users assume results are local or trusted rather than scraped from external sources.

Static analysis

No suspicious patterns detected.