Security audit

Gemini Personal Intelligence：个人与工作上下文助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language workflow for separating personal and work context with optional user-authorized AI-HIVE use; I found no hidden execution, persistence, or credential collection.

Install only if you are comfortable using a Chinese-language workflow that may help organize personal and work materials and can optionally connect to AI-HIVE. Review upload scope, budget, and authorization prompts carefully, and do not provide passwords, tokens, cookies, verification codes, or full identity documents in chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user assistant/agent for personal and work context, memory, retrieval, and delivery tasks. The supplied code does none of that. Its sole purpose is offline validation of saved result records against a contract and local artifact metadata. It performs schema/invariant checks, authorization-reference consistency checks, secret-pattern detection, and local file hash/path validation. There is no evidence of conversational assistance, personal context handling, document answering, delivery generation, tool orchestration, or integration with Gemini/Google-like products. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill describes reading local assets and reference files and mentions offline checking, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent system, undeclared file access increases the chance of overbroad or unintended reads, making it harder to enforce least privilege or audit what the skill is allowed to access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger description covers many synonymous product names and several distinct task classes without strong exclusion criteria, which can cause the skill to activate in contexts it should not handle. For a skill dealing with personal and enterprise data separation, mis-triggering is risky because it can pull the wrong workflow into sensitive conversations and increase the chance of inappropriate data access or disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Listing many common near-synonyms under 'covered names' without saying whether they are discovery aliases or actual invocation triggers makes routing behavior ambiguous. In a context-heavy assistant, that ambiguity can lead to accidental activation for unrelated products or requests, increasing exposure of sensitive personal/work context and causing users to rely on the wrong process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The display name, short description, and default prompt are all written in Chinese and the prompt instructs operation in that language, but the file does not offer any user language choice or explain a justified region-specific requirement. This creates a natural-language locale policy issue because the skill appears to enforce a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill document is written in Chinese and does not state that language selection is optional or user-driven. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file imposes a single language for the skill's instructions and outputs, which can violate language/locale policy when no user opt-in or documented regional justification is provided. The content does not mention that Chinese is optional, configurable, or required for a specific compliance context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language note is written only in Chinese, which may impose a language expectation on users without any opt-in or alternative locale support. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly justifies a region-specific limitation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.