Security audit

camera-recommendation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed camera-shopping recommendation helper with broad triggers but no evidence of hidden code, credential access, destructive behavior, or data exfiltration.

Before installing, be aware that general phrases like asking for a camera recommendation may trigger this skill automatically. Its price and shopping guidance is localized to Mainland China and CNY, so users in other regions should ask for their own region and verify current prices before buying.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger examples include very broad, natural phrases such as '推荐相机' and '帮我选一台适合旅游的相机', which are likely to appear in ordinary conversation and can cause the skill to activate unintentionally. In an IDE assistant context, overly generic triggers can hijack unrelated chats, inject unwanted workflow behavior, or expose users to unexpected model/tool use when they did not explicitly intend to invoke the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger keyword "摄影器材" is broad and can refer to photography equipment in general, including lenses, lighting, bags, or non-purchase conversations. In a manifest file, this lack of specificity can cause the skill to activate outside its intended scope of recommending camera purchases.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The metadata fixes the skill to "zh-CN" and "China Mainland", while the skill also includes English trigger phrases, suggesting possible use by users outside that locale. Under the policy, forcing a specific language or locale without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The English trigger phrases "camera recommendation" and "recommend a camera" are broad enough to match ordinary conversation, which can cause the skill to activate unexpectedly outside a clear user intent boundary. This is not a code-execution issue, but it can lead to incorrect routing, unintended invocation, and user confusion if the system auto-triggers skills based on natural language overlap.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document is written entirely in Chinese and describes the skill behavior in Chinese, while also mentioning bilingual triggers later, but it does not state that users may choose their preferred output language. This can be a language-policy concern because the skill documentation implicitly defaults to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README is entirely written in Chinese and presents the skill as operating in Chinese without indicating that other languages are supported or that the language choice is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the regional constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The file defines a region-specific skill for China Mainland and includes Chinese trigger phrases and pricing, but the prescribed output format is fixed in English and there is no explicit user opt-in or language selection behavior. This can create a language/locale policy issue because the skill appears to force a response language regardless of user preference.
Content: No source excerpt is available for this finding.