Security audit

个人Agent接管与撤销助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language assistant for stopping or reversing agent actions, with cautious authorization rules and no evidence of hidden execution or data theft.

Install this only if you want a Chinese-language workflow for pausing agent activity and preparing recovery records. Before connecting AI-HIVE or any MCP tools, confirm the discovered tools, upload scope, pricing, and budget, and require separate explicit approval for sending, paying, deleting, posting, refunding, or modifying business systems.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is a stop/recovery assistant, but the observed behavior includes offline validation, local file reads, hashing, and invariant/provenance checks that are not clearly disclosed in the top-level description. This mismatch can mislead users and security reviewers about the true trust boundary and data handling behavior, causing them to approve or run a skill with broader local-data access than expected.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill appears to rely on local file-reading behavior (for templates, references, and the mentioned validation script) but does not declare any tool scope or allowed-tools boundary. Missing capability declarations weaken least-privilege controls and make it harder for the runtime or reviewer to understand what filesystem access the skill expects, increasing the chance of overbroad file access or accidental misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s user-facing description and operating instructions are entirely in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the limitation is explicitly justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON test-case file encodes all user inputs and expected behaviors exclusively in Chinese, which implies a fixed language/locale assumption in the skill behavior examples. Under the stated policy, forcing a specific language without user choice or a documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill document is written as an unconditional Chinese output contract, with no indication that users may choose another language or that the skill is limited to a Chinese-only compliance context. This creates a natural-language locale policy concern because it implicitly enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill instruction file is written in Chinese and provides no indication that the user can choose another language or locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language note is written only in Chinese, which can impose a language expectation on users without any opt-in or justification. The policy requires flagging language or locale constraints when the skill does not offer a choice or clearly document that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.