Intelligence Brain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent company-intelligence purpose, but it should be reviewed because it can route sensitive company information to external models or cloud storage and delete source data without clear safeguards.

Install only after reviewing and constraining the data flows: require local pre-classification before any external model call, disable cloud mirroring for sensitive messages, limit sources and recipients, and define explicit approval, retention, recovery, and audit policies before enabling automatic deletion or background heartbeat workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/pipeline-playbook.md:6

Finding

Sensitive information is sent to external models before classification

Content

View full analysis

Vulnerability Details

File Location: references/pipeline-playbook.md:6-8, 14-23, 65-75
Vulnerability Type: Sensitive-data disclosure caused by late classification
Risk Level: High

Evidence

markdown

## Pipeline SLA

- **Time budget**: 24 hours from ingestion to completion
- **Failure policy**: If any step cannot complete, flag for manual review, do not skip
- **Output format**: Markdown files in `company/data/signals/`
- **Model**: Steps 1-7 use free tier (zai/glm-4-flash). Step 8 uses premium for quality inference.

markdown

Sources:
- Department daily reports (`company/departments/*/reports/`)
- External feeds (RSS, news, research)
- CEO directives and strategy updates
- Customer feedback and inquiries
- System events (cron failures, errors, anomalies)

**Output**: `company/data/signals/raw/ingest_{YYYYMMDD}.md`

markdown

## Step 4: ORGANIZE — Categorization

**Goal**: Tag and bucket every atom by domain and classification level.

Taxonomy:

Domain tags: #brand #sales #finance #legal #tech #market #ops #risk Classification: 🔴TS 🟠C 🟡I 🟢P Priority: P0 (urgent) / P1 (important) / P2 (standard) / P3 (background)

text

Technical Analysis

The pipeline directs Steps 1 through 7 to use the external zai/glm-4-flash model. However, information classification is not assigned until Step 4. The earlier collection, parsing, and decomposition stages can therefore send unclassified raw content to an external model before determining whether it is Top Secret, Confidential, Internal, or Public.

The affected sources explicitly include CEO strategy directives, customer inquiries, departmental reports, and operational incidents. These sources can contain personal, commercial, strategic, or security-sensitive information. A later classification decision cannot revoke data already disclosed to an external service.

This behavior also conflicts with the local-o ...[truncated 1417 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a mandatory local pre-classification stage before ingestion content is sent to any external model.
2. Treat unknown, ambiguous, or failed classifications as Top Secret by default.
3. Restrict external-model processing to content explicitly classified as eligible for that provider.
4. Process Top Secret content exclusively with approved local models and local storage.
5. Redact customer identifiers, credentials, internal hostnames, legal details, and strategic data before any permitted external request.
6. Enforce classification at every pipeline boundary rather than only during the organization or use stages.
7. Maintain a model-provider allowlist that records permitted classification levels, retention terms, geographic restrictions, and contractual controls.
8. Add automated tests that submit marked Top Secret documents and verify that no external model or network destination is contacted.
9. Record auditable routing decisions without copying sensitive document bodies into general-purpose logs.

T09 · Insecure Skill Coding Practices

Error

• Location: references/neural-chain-design.md:8

Finding

Unconditional cloud mirroring can disclose classified agent communications

Content

View full analysis

Vulnerability Details

File Location: references/neural-chain-design.md:8-15
Vulnerability Type: Unrestricted replication of sensitive communications to cloud storage
Risk Level: High

Evidence

markdown

Every communication path must have 3 independent channels. But 3 channels shouldn't mean 3x the complexity. The channels should be layered so that failure at one layer is invisible at the next.

Layer 1: Direct (sessions_send) → Fastest, real-time Layer 2: File-based (shared directory) → Async, auditable Layer 3: Cloud (Tencent Docs) → Cross-platform, resilient

text

An agent writes to Layer 1, and the brain ensures Layer 2 and Layer 3 mirror it automatically. Agents read from any available layer.

Technical Analysis

The communication design automatically mirrors every direct agent message to both a shared directory and Tencent Docs. No classification check, redaction step, destination allowlist, or exception for Top Secret and Confidential messages is specified before cloud replication.

The unconditional mirroring rule conflicts with the local-only rule for Top Secret information in SKILL.md:133-139. Even if model routing correctly keeps Top Secret information away from cloud models, an agent can still transmit the same information through sessions_send, after which the communication layer automatically copies it to cloud storage.

Replication also increases the number of stored copies and access-control surfaces. The design allows agents to read from any available layer, but does not define per-agent authorization, tenant isolation, link-sharing restrictions, encryption requirements, or cloud retention limits.

Attack Path

1. An agent prepares a message containing classified strategy, customer information, credentials, incident data, or another sensitive record.
2. The agent sends the message through the direct sessions_send channel.
3. The brain automatically mirrors the ...[truncated 1086 chars]

Remediation

View remediation

Remediation Suggestions

1. Classify every message locally before selecting communication channels.
2. Disable cloud mirroring by default for Top Secret and Confidential messages.
3. Replace unconditional replication with a classification-aware channel policy:
   • Top Secret: approved local direct and local encrypted storage only.
   • Confidential: explicitly approved destinations with strict access controls.
   • Internal: organizational cloud storage only when required.
   • Public: all approved channels.
4. Require explicit user or policy authorization before enabling Tencent Docs synchronization.
5. Apply field-level redaction or message summarization before permitted cloud replication.
6. Use least-privilege service accounts, private documents, restricted sharing, multifactor authentication, encryption, and tenant-scoped access controls.
7. Define retention periods and implement verified deletion across the direct, file-based, cloud, backup, and audit-log copies.
8. Record delivery metadata without duplicating classified message bodies in broadly accessible logs.
9. Add automated policy tests proving that classified messages never produce cloud API requests.
10. Generate a blocking security alert when classification is missing or a prohibited destination is selected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly markets automatic ingestion, processing, actioning, and deletion of company information, but provides no warning, constraints, approval model, or safety boundaries for handling sensitive enterprise data. In the context of a company intelligence engine with cross-file inference and secrecy routing, this omission can lead users to deploy autonomous data flows that over-collect, misuse, or delete sensitive information without informed consent or adequate controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill defines trigger phrases such as “知识图谱”, “决策支持”, “AI大脑”, and “信号处理”, which are broad, generic concepts likely to appear in many unrelated conversations. This can cause unintended invocation of the skill in contexts involving sensitive company data, increasing the chance that internal information is processed or routed when the user did not explicitly intend to use this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that source outputs are marked as consumed and cleaned within 24 hours, but it does not present a clear user-facing safeguard, approval step, or retention exception process. In an intelligence-processing context, automatic deletion can destroy audit trails, remove evidence needed for incident response, and cause irreversible data loss if the pipeline misclassifies material or deletes data the user expected to retain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The playbook instructs deletion of raw and parsed data on a schedule without requiring explicit user approval, recovery controls, backups, or irreversible-action warnings. In an intelligence-processing workflow, this can cause loss of auditability, evidence, and source material needed to verify conclusions or investigate mistakes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file contains natural-language examples and field values in Chinese, and the document does not state that the skill is intentionally limited to Chinese-speaking users or a specific region. Under the language/locale policy rule, forcing or assuming a specific language without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The ingestion step aggregates departmental reports, customer feedback, CEO directives, external feeds, and system events into a shared processing flow, but it does not define privacy boundaries, handling restrictions, consent, or minimization requirements. In this skill's context, the engine is explicitly designed to centralize and redistribute sensitive company intelligence, so missing data-handling controls increases the risk of oversharing confidential or personal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L118 refers to the archive destination as "存藏库," introducing a specific language choice inside an otherwise English document. Because the file does not explain that this locale is required or offer an alternative, it can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.