Security audit

AI 情报车间

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AI-industry research and content-generation skill; its main risks are broad activation, web-research hygiene, and output filename handling rather than hidden or destructive behavior.

Install only if you are comfortable with the agent browsing the web for the industry/topic you provide and saving confirmed Markdown outputs. Review sources and generated publishing copy before use, and avoid using path-like industry names such as ../ or absolute paths until the skill adds filename sanitization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:67
Finding: Untrusted Web Content Is Processed Without Prompt-Injection Defenses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:278
Finding: User-Controlled Industry Names Are Used in Output Paths Without Sanitization
Content: View full analysis
//`, where the date format is `YYYY-MM-DD`. - Store every content item in an independent Markdown file named `-.md`, such as `-WeChat-article.md`, `-Xiaohongshu-copy.md`, or `-Douyin-script.md`. - Store the signal report as `-signal-report.md`. ``` ### Technical Analysis The industry name is supplied by the user and is subsequently interpolated into both directory names and filenames. The Skill does not require validation, normalization, path-separator rejection, canonical-path checks, or collision handling. A malicious industry name can contain path-control characters or components such as: ```text ../../unintended-directory ``` If the hosting Agent constructs the path literally, traversal components can escape the intended `output/` directory. Absolute paths, platform-specific separators, control characters, reserved filenames, or Unicode characters resembling separators may create related problems. The vulnerability is instruction-level rather than an implementation in executable source code. Actual exploitability depends on whether the Agent's filesystem tool independently sanitizes paths or confines writes to a sandbox. The Skill itself supplies no such guarantee. ### Attack Path 1. A user invokes the Skill with a crafted industry name containing `..`, `/`, `\`, an absolute-path prefix, or another unsafe filesystem component. 2. The Agent accepts the industry name because the Skill only requires confirmation or narrowing of th ...[truncated 1229 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description embeds multiple broad trigger phrases without strong scope boundaries, increasing the chance that routing logic or keyword-based dispatch will activate the skill on generic discussion of AI's effect on an industry. Because this skill is high-action—performing online retrieval, multi-stage synthesis, and disk output—accidental invocation has meaningful side effects beyond a simple response.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad natural-language phrases like asking whether AI impacts a sector, which can match ordinary conversation rather than an explicit request to invoke this skill. That can cause unintended activation, leading the agent to perform web research, generate reports, and create files when the user may only be asking a casual question.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description mandates using this skill for a broad set of loosely defined requests such as analyzing AI's impact on any industry or when users need related content generation. This wide trigger surface can cause the skill to activate on general requests where more appropriate, narrower tools should be used, increasing the chance of over-collection, unintended web access, or automatic file creation without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language skill description forces a specific language presentation and usage context without indicating user choice or documenting a justified locale restriction. Under the stated policy, language constraints should either be optional or clearly documented as intentional and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown states that the skill will perform online retrieval and generate content for multiple platforms, which implies sending user-provided industry/topic data to external services or platforms. The README does not include any user-facing warning about network access, third-party data handling, or review before using generated publishing materials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: A language-only presentation can violate locale or language choice expectations when the skill does not explicitly indicate user opt-in or a justified region-specific constraint. This file contains no note that Chinese is required, optional, or specific to a Chinese-only deployment context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.