Security audit

Deepmine 5.1

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only questioning skill with no system access, but it needs Review because it includes under-disclosed tax/legal risk triage and keeps user-provided details in a per-turn state block.

Review before installing. This skill appears safe from a local-system perspective, but install it only if you are comfortable with a Chinese guided-questioning workflow, optional finance/tax/legal risk triage, and per-turn state that records user-provided planning details. Treat compliance outputs as triage, not professional advice, and avoid entering highly sensitive legal, financial, or business information unless the host platform handles hidden state and logs appropriately.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file implements a tax/legal risk extraction and screening workflow that materially differs from the manifest’s described Socratic questioning skill. This creates a hidden capability shift: users or orchestrators expecting reflective questioning may instead trigger specialized compliance analysis, which can bypass governance, routing, and safety expectations for the declared skill.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The skill contains specialized financial/legal risk screening, including criminal red-line detection for fraud, money laundering, bribery, and tax crimes, despite the manifest presenting a generic reflection/planning assistant. Undeclared regulated-domain analysis is dangerous because it can cause the agent to process sensitive legal/compliance scenarios without appropriate user consent, policy gating, or expert-review boundaries.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: Although the prompt says it only extracts hidden needs or risks, the examples and rules instruct the model to emit directive legal-style language such as '请立即停止' and '请咨询专业律师.' This mismatch increases the chance of unauthorized professional guidance and makes the skill behave more prescriptively than advertised.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The handler contains conflicting control instructions: one section requires every reply to include a next question, while a later higher-level rule says to restate and not ask a follow-up in the same turn. In an agent setting, contradictory directives can cause unstable behavior, policy misexecution, and make downstream orchestration unreliable because the model may choose the wrong branch unpredictably.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The file requires an affirmative opening but later prohibits common affirmative phrases as evaluative language, creating ambiguity about what responses are allowed. This is dangerous mainly because it degrades consistency and may push the model into either violating style constraints or omitting required acknowledgment, reducing trust and predictability rather than causing direct security compromise.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger phrases are broad everyday requests such as '帮我做个方案' and '我不知道该怎么办', which can cause the skill to activate in many normal conversations where the user did not explicitly ask for this structured interrogation workflow. That creates a routing and consent problem: the model may over-collect context, steer the interaction, or suppress more appropriate skills unexpectedly.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill metadata and content require Chinese-language behavior without checking the user's language preference. This is primarily a safety/usability issue because it can override user expectations, reduce clarity, and increase the chance of misunderstanding in sensitive planning or reflection tasks.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The handler hard-codes Chinese-language interaction and examples throughout, with no mechanism to detect or honor the user's language preference. This can cause unsafe misunderstanding, exclusion, or mishandling of user intent when the surrounding agent is invoked by users who communicate in other languages.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The handler is written entirely in Chinese and operationally assumes Chinese-language interaction, with no indication of language negotiation or fallback. This can override or conflict with a user's preferred language, causing the agent to ignore user intent, degrade accessibility, and produce unsafe misunderstandings in sensitive decision-support conversations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file is entirely in Chinese and does not provide a language choice or explain a justified locale restriction. In a general-purpose agent skill, this can exclude users, reviewers, or operators who do not read Chinese, reducing transparency and making safe use, auditing, and troubleshooting harder.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the model to append and reuse a hidden '<state>' block every turn and to produce a final summary composed of the user's original words. In a reflective or requirements-gathering skill, that encourages persistent retention and reproduction of potentially sensitive user content, increasing the risk of accidental disclosure in later turns, logs, UI leakage, or cross-context exposure.

Static analysis

No suspicious patterns detected.