T09 · Insecure Skill Coding Practices
Error
- Location
references/conversation-flow.md:10- Finding
Persistent Collection and Storage of Location and Health-Adjacent User Profiles
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiao Chuang You
Security checks for vulnerabilities and agentic risk
Overview
This lifestyle guide is mostly coherent, but it asks to persist location and health-adjacent user details and declares an automatic monthly memory-checking job, so it needs review before installation.
Install only if you are comfortable with the skill storing personalization data locally and possibly running a recurring background memory check. Avoid sharing medical details, diagnoses, medications, or highly private location information; review or delete /workspace/MEMORY.md and memory summaries if used, and verify any cron task and third-party links before relying on them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T06 · System Persistence
Error
- Location
references/data-declaration.md:81- Finding
Declared Recurring Task Inspects Persistent User Memory Outside Active Sessions
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
references/modules/饮食.md:19- Finding
Mandatory Third-Party Link and Engagement Template Injected into Recipe Responses
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/conversation-flow.md:79- Finding
Insomnia Diagnostic Classification Contradicts the Skill's No-Diagnosis Policy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (27)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill declares extremely broad trigger phrases such as '有什么推荐吗', '帮我推荐', '我想知道', and '怎么办', which are common in everyday conversation and not specific to this skill’s domain. This can cause the skill to activate on unrelated user requests, intercepting queries meant for other skills or default safety-aligned handling and increasing the chance of inappropriate routing or overreach.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill hard-codes a Beijing-time greeting on every reply without user opt-in, forcing a single locale assumption and requiring use of a message timestamp rather than adapting to user preferences. While not directly a code-execution risk, this can produce misleading contextual behavior, degrade user trust, and interfere with platform-level localization or assistant policies.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file describes the skill as a Chinese-culture aesthetic AI using Chinese-only natural-language framing, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs the agent to collect and remember health-related state such as body constitution, insomnia, fatigue, and mood in memory or session context, but it does not require a clear user-facing notice, consent flow, or retention boundary at the time of collection. Even if framed as wellness guidance rather than medical care, storing health-adjacent personal data without transparent disclosure increases privacy risk and can lead to inappropriate persistence of sensitive information across conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The memory rules instruct retention of user city/climate, current condition, and preference data, but there is no explicit privacy warning or user consent mechanism tied to that retention. Location and condition data can become sensitive in aggregate, especially when combined over multiple sessions to profile health, routines, and whereabouts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file discloses that daily conversation summaries are stored in local files, but it does not clearly and prominently warn users that these summaries persist beyond the current session. In a lifestyle and wellness skill that elicits personal feelings, health-adjacent details, location, and preferences, this can lead users to share sensitive information without fully understanding that it will be retained across time.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains natural-language instructions that require replies to use specific Chinese greetings such as 「晨安」「午安」「夜安」. Because the rule is framed as a mandatory structure requirement and does not provide user opt-in or language choice, it constitutes a locale/language policy concern under SQP-3.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L06-L07 的激活词包含“出行”“旅行”“周边”等高频日常表达，且未说明必须在何种上下文下才触发该技能。这类词汇与普通对话高度重叠，容易造成误调用，符合模糊触发条件。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation keywords are very broad everyday sleep-related terms such as '累', '怎么办', and common phrases around fatigue/insomnia, which can cause the skill to trigger on many general health or emotional queries beyond the user's intent. In a lifestyle/health-advice skill, over-triggering is risky because it may steer users into unqualified wellness or sleep guidance in contexts that may require medical, mental health, or other specialized handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation keywords are broad enough to match ordinary health-related queries such as symptoms, discomfort, or self-care questions, which can cause the养生 module to trigger in situations that may border on medical advice. In a health-adjacent skill, this increases the chance of users receiving wellness guidance when they may actually need qualified medical triage, making misrouting more safety-relevant than in a purely lifestyle domain.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation list includes very common single-word triggers such as “香” and broad lifestyle terms that are likely to appear in ordinary conversation, increasing the chance of unintended invocation. In an always-on or multi-skill routing environment, this can cause the skill to activate outside its intended scope, leading to confused responses, misrouting, or overshadowing more appropriate skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation terms are broad, generic gardening words such as '园艺', '种花', '浇水', and '绿植', which are likely to appear in ordinary conversation and can cause the skill to trigger when the user did not intend to invoke it. This creates routing ambiguity and unintended skill activation, which can degrade system reliability and potentially surface irrelevant advice in contexts where a different skill should respond.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes very broad everyday terms such as '热' and '冷', which can cause the skill to activate in contexts unrelated to weather. This increases the chance of accidental invocation, misrouting user requests, and unintended handling of conversations by this skill instead of a more appropriate one.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation list includes broad everyday terms such as “猫”, “狗”, and “宠物”, which can match many ordinary conversations and cause the skill to trigger outside the user’s actual intent. In a skill that gives lifestyle and pet-care guidance, unintended activation can inject irrelevant or quasi-health advice into conversations, increasing the risk of confusing or inappropriate responses.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad and overlaps heavily with ordinary conversational phrases such as '心情', '压力', and '怎么办', which can cause the emotion module to activate for many general requests that were not meant for it. In a mental-health-adjacent module, over-triggering is risky because users may receive emotionally framed guidance or quasi-wellness advice in situations where another, more appropriate module should respond.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation list includes very generic terms such as “做”, “材料”, and “DIY”, which are common in everyday queries and can cause the skill to trigger outside its intended handcraft domain. Over-broad routing increases the chance of response hijacking or misclassification, where users seeking unrelated advice are handled by this module and receive inaccurate or unsafe guidance involving tools or materials.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L06-L07 将“摄影、拍照、构图、光影、取景、角度、焦段、滤镜”等列为激活词，其中多项是常见泛化词汇，容易与一般交流或其他创作/设计场景重叠。文件也未说明触发边界、限定上下文或排除示例，因此难以判断该技能何时应激活、何时不应激活。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation list includes broad terms such as “诗”, “词”, “读书”, and “阅读”, which are common in ordinary conversation and can trigger the module outside the user’s intended context. This can cause unintended routing or over-activation of the literature skill, reducing reliability and potentially surfacing inappropriate domain-specific advice when the user meant something else.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation terms are quite broad and overlap with common lifestyle queries, which can cause the穿搭 module to trigger outside its intended scope. This can lead to unintended routing, confusing responses, or inappropriate module selection, especially because the skill metadata already allows broad open-ended activation patterns.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该文件是 markdown，适用 SQP-1。激活词列表中包含“音乐”“歌单”等高频日常词汇，且未说明触发边界、上下文限制或排除条件，容易与普通对话重叠并造成误触发。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad everyday terms such as '吃什么', '食材', and '饮品', which can cause the skill to activate on generic conversations not specifically seeking this module. Over-triggering can misroute user requests, cause unintended handling of adjacent topics like health or pet diet, and increase the chance that advice is delivered out of context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file defines a fixed Chinese response template and instructs the agent to structure replies in that style, but it does not indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all user-facing capability and fallback descriptions exclusively in Chinese. Under the policy rule for natural-language violations, forcing a single language without opt-in or justification can be a locale policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The entire document specifies the assistant persona and example dialogue exclusively in Chinese, which suggests a fixed language behavior. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified or the user is offered a choice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The monthly scheduled job is described, but the warning is not sufficiently explicit that it runs automatically outside an active user conversation and may inspect or update memory data without a contemporaneous user action. This weakens informed consent and transparency around background processing of stored personal preference data.
- Content
Static analysis
No suspicious patterns detected.