Historical Guide

• Outcome: Pass
• Latest audit: May 28, 2026 · 4:51 AM UTC
• Version: 1.1.8

Overview

This skill is a coherent LLM-powered museum guide, but users should know it sends prompts to a configured model API and can save generated persona files locally.

Install only if you are comfortable sending museum queries and conversation text to the configured model provider. Use a trusted API_BASE, a least-privilege API key, and avoid entering sensitive personal data. Review or delete generated files in references/ if you use out-of-library personas, because those profiles are synthetic and may be inaccurate or malformed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no explicit permissions while its documented workflow clearly requires sensitive capabilities including environment access, local file read/write, shell execution, and outbound network access. This creates a transparency and consent problem: users may enable a seemingly simple museum guide without understanding that it can call external APIs, execute scripts, and persist generated data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior goes beyond a passive museum narration skill and includes external model calls, dynamic persona generation for arbitrary people, and persistent storage of generated personas. That mismatch is dangerous because users may disclose conversation content or invoke functionality they did not reasonably expect, especially when third-party transmission and local persistence are involved.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: Allowing automatic generation and persistent storage of personas for any out-of-library historical figure expands the trust boundary well beyond a fixed-content museum explainer. This increases risk of hallucinated, inappropriate, or policy-bypassing content being materialized into reusable local assets without meaningful review.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The skill promises to avoid hallucinations and restrict content to historically grounded material, yet it also supports dynamically generating personas for arbitrary figures. That inconsistency can mislead users into overtrusting generated content as verified or historically accurate when the workflow inherently introduces speculative synthesis.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: Broad trigger phrases such as generic companion or style-switch requests can overlap with ordinary conversation and cause unintended activation. In this skill, accidental triggering is more concerning because activation may lead to external API use, state changes, or persona switching without the user clearly intending to invoke the tool.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The character-switch signals are loosely defined and may match ambiguous user utterances outside the intended context. Because switching triggers script execution and state updates, an unintended match can alter session behavior or cause unnecessary external/model calls and local state changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill asks for API credentials and a model endpoint but does not clearly warn that user prompts and possibly contextual content will be transmitted to an external service. This is a real data-handling disclosure issue, and in a conversational skill it can expose sensitive user inputs or museum-related context to third parties without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends both user-provided relic names and persona-derived prompt content to an external LLM API via requests.post without any visible notice, consent flow, minimization, or boundary on what persona data may contain. In a museum-guide skill this is expected functionality, but it still creates a privacy and data-governance risk because user input and internal prompt data leave the local trust boundary and are exposed to the configured third-party endpoint.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends raw user conversation content to an external LLM API for intent analysis without any visible disclosure, consent, minimization, or redaction. In an interactive museum-guide setting, users may reasonably assume local processing and could unknowingly transmit personal data or sensitive queries to a third party.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill sends prompts, relic queries, and dialogue content to an external LLM API without visible disclosure or consent controls. Because this is an immersive conversational tool, the context makes accidental over-sharing more likely, increasing privacy and compliance risk even if no exploit is intended.

Ssd 1

Medium

• Confidence: 95% confidence
• Finding: The user-controlled character name is interpolated directly into the model prompt used for the suitability check. An attacker can supply prompt-shaped text rather than a name, causing the model to ignore the intended classification criteria and return '适合', bypassing policy checks and enabling creation of disallowed or malformed personas. In this skill context, that matters because generated personas are subsequently persisted and may influence later museum-guide behavior.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The generation prompt embeds unsanitized user input directly into a JSON-generation request. A crafted input can semantically redirect the model to output non-JSON content, oversized content, or maliciously shaped persona fields that pass minimal required-field checks and then get saved for downstream use. Because the skill persists the generated profile, this becomes stored prompt/content injection rather than a one-off generation failure.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 环境变量 | 说明 | 示例 |
|---------|------|------|
| `API_KEY` | 模型 API Key | `sk-xxx` |
| `API_BASE` | 模型 Base URL | `https://api.example.com/v1/chat/completions` |
| `MODEL_NAME` | 模型名称 | `xxx` |

或创建 `scripts/config.json`：

• Confidence: 84% confidence
• Finding: The presence of a configurable external API endpoint indicates the skill is designed to transmit content off-host. In context, this is not inherently malicious, but it is security-relevant because it expands the data exposure surface and could be abused if pointed to an untrusted or attacker-controlled endpoint.

Static analysis

No suspicious patterns detected.