Security audit

ai-humanlike-config

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed AI-employee configuration package, but it includes unsafe authorization/security utilities, automatic persistent memory behavior, and a bundled audit report that understates executable code.

Review before installing or using in production. Do not rely on license_code.py for real authorization, high-risk action approval, paid capability gating, or freeze controls without rewriting validation. Treat memory, reflection, forgetting, and evolution features as opt-in only, especially for customer data, business records, or children. Ignore the bundled audit report's documentation-only claim and audit the Python tools directly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: tools/license_code.py:30
Finding: Authorization Validator Accepts Arbitrary Unrevoked Strings
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/38-持续进化.md:32
Finding: Attacker-Controlled Feedback Can Be Persisted into Agent Memory or Skills
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: references/04-业务流SOP.md:44
Finding: Skill Directs Agents to Insert Fixed Branding and Promotional Calls to Action
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/license_code.py:23
Finding: Predictable Hardcoded Authorization Secret Is Used When Configuration Is Missing
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tools/id_verify.py:35
Finding: Signing Private Key Is Written Unencrypted without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

other

Warning

Location: 安全审计报告.md:28
Finding: Bundled Security Report Materially Misrepresents Executable and Network Behavior
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as an AI behavior/configuration framework, but also performs standalone file hashing, stamping, integrity verification, and arbitrary file read/write operations for evidence records. That discrepancy matters because integrity tooling touching arbitrary local files can expose sensitive contents or create misleading trust artifacts if users invoke it under false assumptions about the skill's purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as an AI behavior/configuration framework, but also performs standalone file hashing, stamping, integrity verification, and arbitrary file read/write operations for evidence records. That discrepancy matters because integrity tooling touching arbitrary local files can expose sensitive contents or create misleading trust artifacts if users invoke it under false assumptions about the skill's purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as an AI behavior/configuration framework, but also performs standalone file hashing, stamping, integrity verification, and arbitrary file read/write operations for evidence records. That discrepancy matters because integrity tooling touching arbitrary local files can expose sensitive contents or create misleading trust artifacts if users invoke it under false assumptions about the skill's purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code claims the signing key comes from WB_LIC_KEY, but _key() silently falls back to the hard-coded value dev-only-key-change-me when the environment variable is missing. In any deployment where that misconfiguration occurs, anyone who knows or guesses the default can generate valid HMAC signatures, undermining all license levels including potentially high-risk operation or freeze codes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Line L04 states that branding must uniformly use a specific Chinese label and forbids alternatives, with no opt-in, locale choice, or region-specific justification. This is a natural-language policy concern because it enforces a fixed language/locale presentation rule rather than offering flexibility.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises file, network, shell, environment, and write-capable tooling but does not declare any explicit tool scope or permission boundary. In an agent ecosystem, that omission can cause the skill to run with broader ambient authority than users expect, increasing the chance of unintended file access, command execution, network egress, or secret exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation language is extremely broad ('use when the user wants AI help, memory, assistants, teachers, digital employees, etc.'), which increases the chance that the skill auto-triggers for generic requests outside its safe, intended scope. Over-broad triggering can route unrelated conversations into a high-capability skill with file/network/shell reach, raising the risk of unnecessary tool use or privilege exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file markets a '儿童 AI 老师' offering and mentions parent authorization and age-appropriate guardrails only briefly, but it does not clearly state core protections for minors: data minimization, parental supervision requirements, limits on educational or behavioral advice, and restrictions on collecting or exposing children’s personal information. In a child-focused product context, this omission increases the risk of unsafe reliance, inappropriate interactions, and mishandling of minors’ sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document states compliance requirements specifically as '国内（PRC）' and '国际（GDPR 等）' as normative guidance, but it does not clearly say the skill is limited to those jurisdictions or allow users to choose a different legal/locale framework. Under the policy, forcing a specific language/locale or regional policy context without opt-in or justified scope can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file instructs external messaging to use specific Chinese phrasing such as "我们提出/主张" and avoid other formulations. This is a natural-language locale constraint presented as a requirement, with no indication that users or operators may choose another language or opt in to this restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill file is written as Chinese-only operational guidance and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide encourages users to upload business documents, webpages, voice data, or send materials through email/WeChat, but it does not prominently warn about sensitive-data exposure, third-party transmission risks, retention, or consent requirements. In this skill’s context, the omission is more dangerous because the product is marketed for business use, personal assistants, and even children’s AI teacher scenarios, increasing the likelihood that users will submit confidential or regulated data without understanding handling implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The refund text says that configuration and data must be destroyed before a refund, but it does not clearly emphasize that this may cause permanent, irreversible loss of user data, memories, and custom setup. In this context, the digital employee is described as storing memory and accumulated business knowledge, so users may lose valuable operational information if they proceed without a backup/export warning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file mandates a specific compliance regime (PIPL and related China-specific operational assumptions) without clearly scoping that requirement to China-based users or offering region-specific alternatives. In a reusable AI configuration skill intended for SMBs and individuals, this can mislead operators into applying the wrong privacy, payments, and complaint-handling framework in other jurisdictions, creating legal and operational compliance gaps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document explicitly describes automatic write-back of user and customer facts into persistent memory at user, project, and session scopes, but it does not require explicit user notice, consent, or a clear explanation that data will persist across sessions and potentially across projects. In this skill context, the remembered data may include business facts, preferences, and customer information, so silent persistence increases privacy, compliance, and data-minimization risk rather than being a purely UX issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill specifies TTL expiry, conflict resolution, deduplication, and monthly cleanup operations that can alter, merge, deprecate, or effectively remove stored memories, but it does not warn operators about irreversible data loss, accuracy regressions, or auditability gaps. Because this memory layer is positioned as long-term infrastructure for SMB and personal assistants, automatic lifecycle actions on customer-related memory can silently discard evidence, preferences, or historical facts that later decisions may depend on.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file enables autonomous reflection by default and describes self-triggering during idle windows or scheduled execution, but it does not define sufficiently concrete exclusion conditions, scope limits, or consent boundaries. In an agent skill focused on persistent memory and autonomous improvement, this can cause unexpected background processing of user data or unplanned behavior outside the user's immediate request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The autonomous reflection loop is triggered by broad conditions such as cron schedules, idle windows, or generic events, with no clear negative conditions defining when it must not run. Because the loop includes scanning recent interactions, updating memory, and generating plans, overly broad activation can expand agent behavior beyond user expectations and increase the chance of privacy, policy, or operational boundary violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section explicitly instructs the agent to scan recent interactions, write reflection notes, persist lessons into semantic memory, and store append-only records, while only briefly mentioning desensitization elsewhere rather than requiring user-facing notice and consent here. In the context of a skill marketed for enterprise assistants and children's AI teachers, silent retrospective processing materially raises privacy and compliance risk because sensitive conversational content may be reprocessed and retained without clear warning or minimization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document explicitly enables '主动遗忘' and describes low-value, expired, unreferenced memories being archived or cleared, but it does not pair this behavior with a clear user-facing warning, recovery expectation, or approval/retention safeguard. In a memory-management skill for AI assistants, silent deletion can cause irreversible loss of user data, context, or audit-relevant information, especially because the feature is presented as enabled by default and integrated into scheduled consolidation flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill specification is written as Chinese-only operational guidance, with no indication that users may choose another language or locale. Under the policy for natural-language violations, a skill that effectively enforces a specific language without opt-in should be flagged unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI defaults --lang to zh, and the generated package prominently records that language setting. This creates a locale preference by default rather than requiring an explicit user choice, which can violate language/locale policy when no opt-in is obtained.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · tools/id_verify.py (reported line 49)May include surrounding context.
python
) else: import subprocess subprocess.run(["openssl", "genpkey", "-algorithm", "ed25519", "-out", os.path.join(outdir, "signing.key")], check=True) subprocess.run(["openssl", "pkey", "-in", os.path.join(outdir, "signing.key"), "-pubout", "-out", os.path.join(outdir, "verify.pub")], check=True)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · tools/id_verify.py (reported line 51)May include surrounding context.
python
import subprocess subprocess.run(["openssl", "genpkey", "-algorithm", "ed25519", "-out", os.path.join(outdir, "signing.key")], check=True) subprocess.run(["openssl", "pkey", "-in", os.path.join(outdir, "signing.key"), "-pubout", "-out", os.path.join(outdir, "verify.pub")], check=True) return with open(os.path.join(outdir, "signing.key"), "wb") as f:

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · tools/id_verify.py (reported line 74)May include surrounding context.
python
with tempfile.NamedTemporaryFile("w", suffix=".bin", delete=False) as tf: tf.write(payload) tfn = tf.name subprocess.run(["openssl", "pkeyutl", "-sign", "-inkey", key_path, "-in", tfn, "-out", tfn + ".sig"], check=True) sig = open(tfn + ".sig", "rb").read() os.unlink(tfn); os.unlink(tfn + ".sig")