Security audit

老板交办进度秘书

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language delegation-board workflow with optional AI-HIVE/MCP use and clear limits around credentials, payments, sending, deletion, and external writes.

Install only if a Chinese-language delegation workflow tied to AI-HIVE is what you want. Review any MCP/OAuth authorization, upload scope, budget, and external actions before use; do not provide passwords, tokens, cookies, or verification codes in chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose says this skill performs executive-assistant workflow generation and optional AI-HIVE/MCP-backed execution, but the analyzed behavior reportedly only does offline result recording and local artifact hash validation. This mismatch is dangerous because users or orchestrators may grant it trust, data access, or invoke it in sensitive business workflows under false assumptions, leading to mishandling of approvals, incomplete task execution, or unsafe automation decisions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger language is broad ('老板AI秘书', '私人助理', 'CEO Assistant', 'AI参谋长') and overlaps with common conversational requests, which can cause the skill to activate in contexts beyond its intended narrow workflow. In a business-assistant setting, over-triggering is risky because it may pull sensitive task, personnel, deadline, or visibility data into the wrong workflow or cause an agent to apply this skill when a simpler informational response was appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire skill document is written in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file imposes a specific language for the skill's instructions and outputs, but it does not mention that the user can opt into another language or that the skill is intentionally limited to a Chinese-language context. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a boss delegation board/secretary skill that turns assignments into a board, decision list, and follow-up drafts. This checker explicitly models and validates records for mutating action kinds such as "send", "pay", and "delete", which goes beyond merely representing delegation progress and suggests support for operational execution categories not justified by the described deliverables.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.