T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:145- Finding
Immutable Governance Instructions Assign Control to Hard-Coded Identities
- Content
View full analysis
- Remediation
View remediation
Security audit
Opc Os Core
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed multi-agent company automation template, but it recommends persistent autonomous publishing and cloud-document fallback without enough approval, scoping, or data-control safeguards.
Review this carefully before installing. Use it only if you want a Chinese-language, Asia/Shanghai-oriented multi-agent operating framework. Do not enable the cron templates as written: make the monthly SkillHub maintenance job report-only, require explicit approval before any publish or public post, restrict credentials to least privilege, and disable cloud-document fallback unless destinations, permissions, retention, and sensitive-data rules are defined.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
references/cron-orchestration.md:70- Finding
Persistent Scheduled Job Can Republish Skills Without Explicit Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/communication-protocols.md:62- Finding
Communication Failure Can Route Internal Data to External Cloud Documents
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The monthly maintenance job instructs the system to compare published skills with local versions and republish on differences, which is a system-affecting action with external consequences. Automating publication without explicit approval, change review, or warnings can propagate faulty, unsafe, or tampered skill content at scale, making this substantially riskier than simple file generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The listed trigger terms include generic phrases such as “AI公司”, “自动化运营”, “AI运营”, and “Agent团队”, which can appear in ordinary conversations about AI business or automation. The description does not provide negative examples or clear scope constraints to distinguish when the skill should activate versus when these terms are merely being discussed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill strongly encourages cron-driven autonomous publishing, communications, and operational actions across external platforms without clear safety gates, human approval points, or warnings about account, data, and reputational risk. In this context, automation touching public posting, legal review, model routing, and multi-channel messaging can cause unintended publication, policy violations, sensitive data exposure, or account sanctions if users deploy it as described.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly recommends persistent shared-file message boxes and cloud-backed collaboration for inter-agent communication, but it provides no guidance on data classification, access control, retention, or handling of sensitive content. In an autonomous multi-agent company OS, agents may place business, legal, financial, or personal data into these channels, creating a realistic risk of unintended disclosure, excessive retention, or cross-department overexposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The fallback to Tencent Docs / Feishu Docs introduces transmission of potentially sensitive internal data to external third-party services, yet the protocol does not mention consent, tenant controls, sharing restrictions, jurisdiction, or secrets handling. Because this skill coordinates multiple autonomous departments and cross-machine operation, the cloud fallback materially expands the attack surface and can expose internal strategy, customer, legal, or finance data outside the local trust boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document defines unattended cron jobs that cause persistent file writes under company/departments/* without any explicit warning, approval boundary, or safeguards around overwrite behavior. In an agentic operating-system skill, hidden data-modifying automation increases the risk of unintended state changes, log/file sprawl, and silent corruption if prompts or paths are misconfigured.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The weekly inspection workflow automatically generates reports to persistent storage but does not warn users that the automation changes local state on a schedule. Because this skill presents a largely autonomous multi-agent company OS, undocumented report-writing can normalize background file mutation and make operational artifacts appear without clear operator consent or retention expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file embeds core governance templates and rule content in Chinese throughout, including titles and operational rules, without indicating that users may choose another language or that the skill is limited to a Chinese-language context. This can violate language/locale policy because it imposes a specific language by default rather than offering opt-in or documenting a justified regional requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill’s user-facing name, summary, description, and introductory guidance are presented entirely in Chinese, with no indication that other languages are supported or that the user can choose a preferred locale. This can amount to a language/locale policy issue when a skill effectively forces one language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The only concrete communication example uses Chinese text, and the title also includes Chinese wording, which may signal an implicit language requirement. Because no user choice or locale justification is provided in the file, this could conflict with a language/locale policy that requires opt-in or documented constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The title and embedded task messages establish a Chinese-language/Asia-Shanghai operating context, but the document does not offer any language or locale choice or explain why this locale is required. This can be a natural-language policy issue when a skill effectively forces a specific language/locale without opt-in.
- Content